IOPB bit semantics are inverted from what you might expect: 0 means permitted, 1 means denied. So zeroed pcb memory silently grants access to every port in range -- that's why this was consistently reproducible, not flaky. One sizeof() away from correct the whole time.