(baseline run, DFBATCH kernel, serial console; the run speaks for itself)
DFB: === cmd='ehci selfcycle' ===
DFB-ehci[selfcycle]: calling verbatim ehcsi_pci_take_controller()
DFB-ehci: EREAD4(off=0x8) -> 0x5000 (HCCPARAMS: EECP=0x50)
<no further console output; ssh dies; guest wedged; even the serial login
 prompt stops being served; QEMU had to be killed -9 from the host.
 The linear control on the same rig returns in microseconds
 (pci_reads=3, cfg_off_range=[0x40..0x50]).
 The loop is `for (eecp=0x50; eecp!=0; eecp=EHCI_EECP_NEXT(eec))` with
 cfg[0x50]=0x500A -> NEXT=0x50 forever: no exit by construction.
 The rig's 20s watchdog callout never managed to fire -- the spin starved
 even the panic path; the wedge itself is the observation.