== [1] apple_smc_sms_intr reads ASMC_INTPORT_READ unconditionally ==
void
apple_smc_sms_intr(void *arg)
{
	device_t dev = (device_t)arg;
	struct apple_smc_softc *sc = device_get_softc(dev);
	uint8_t type;

	if (!sc->sc_sms_intr_works)
		return;

	SMC_LOCK(sc);
	type = ASMC_INTPORT_READ(sc);
	sc->sc_sms_intrtype = type;
	SMC_UNLOCK(sc);

	apple_smc_sms_printintr(dev, type);

	if (type == ASMC_ALSL_INT2A && sc->sc_has_alsl)
		return;

	taskqueue_enqueue(sc->sc_sms_tq, &sc->sc_sms_task);
}

== [2] ASMC_INTPORT_READ = bus_read_1(sc->sc_ioport, 0x1f) ==
113:#define ASMC_INTPORT_READ(sc)		bus_read_1(sc->sc_ioport, 0x1f)
== [3] sc->sc_ioport allocated ONLY when !sc_is_mmio ==
	/* Try MMIO first */
	sc->sc_rid_mem = 0;
	sc->sc_iomem = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
	    &sc->sc_rid_mem, RF_ACTIVE);
	if (sc->sc_iomem != NULL) {
		if (apple_smc_try_enable_mmio(dev) == 0) {
			sc->sc_is_mmio = 1;
			device_printf(dev, "using MMIO backend%s\n",
			    sc->sc_is_t2 ? " (T2)" : "");
		} else {
			bus_release_resource(dev, SYS_RES_MEMORY,
			    sc->sc_rid_mem, sc->sc_iomem);
			sc->sc_iomem = NULL;
		}
	}

	if (!sc->sc_is_mmio) {
		sc->sc_ioport = bus_alloc_resource_any(dev, SYS_RES_IOPORT,
		    &sc->sc_rid_port, RF_ACTIVE);
		if (sc->sc_ioport == NULL) {
			device_printf(dev, "unable to allocate IO port\n");
			ret = ENOMEM;
			goto err;
		}
	}
== [4] IRQ handler registered whenever sc_has_sms (backend-blind) ==
478:	ret = bus_setup_intr(dev, sc->sc_irq, INTR_MPSAFE,
479:	    apple_smc_sms_intr, dev, &sc->sc_cookie, NULL);
== [5] sc_has_sms detection works over either backend ==
73:	if (sc->sc_is_mmio)
110:	if (sc->sc_is_mmio)
148:	if (sc->sc_is_mmio)
196:	if (sc->sc_is_mmio) {
== [6] bus_read_1 -> rman_get_bustag = plain deref ==
151:#define rman_get_bustag(r)	((r)->r_bustag)
565:#define bus_read_1(r, o) \

CHAIN CONFIRMED: MMIO Mac with SMS + SMC IRQ => apple_smc_sms_intr
=> bus_read_1(NULL, 0x1f) => rman_get_bustag(NULL) => NULL->r_bustag
=> page-0 fault in interrupt context => panic.