The problem is the FIS registers have stale data.
SeaBIOS initialization leaves the registers:
PORT_FIS_ADDR = 0x7fae0000
PORT_FIS_ADDR_HI = 0x0
My OS initializes DMAR page tables and then enables the IOMMU translation.
Then OS initializes AHCI driver. Writes VIRTUAL DMA to FIS registers.
eg. FIS DMA address is 0x10000 (maps to some hardware physical address via iommu)
The OS writes 0x00 PORT_FIS_ADDR_HI -> qemu calls map_page (0x00 << 32) | 0x7fae0000... 0x7fae0000 is stale, and is not in the IOMMU page map. Causes a non-recoverable IOMMU fault.