Comment 6 for bug 1878255

Forgot to mention:

4. the last write to PxSCTL is what actually causes the reset by clearing the DET bit that was armed.

In response to Philippe: Yes, if you had a malicious kernel or root access to the guest, you could emit a sequence of PIO and memory write operations to trip this. Even the reproducer CLI omits -accel qtest, so at a minimum a malicious firmware image that's guaranteed not to be interrupted could trigger the race condition.