The bug turned out to be memory corruption by DMA, and
the corrupted address made it that much more obvious.