the laptop’s bios has a party trick: as i described before, int 13h works fine until the cpu enters protected mode, then it never returns, not even for a no-transfer disk reset. bios toggles didn’t help, so borealis is growing a native usb driver. first part: find the ehci controller over pci, do the formal ownership handshake (there’s an actual semaphore register in config space where the os and the bios’s smm ghost take turns. set our bit, wait for theirs to clear, then kill every smi source so the ghost stops getting summoned), reset the controller, spin up an idle async schedule, scan the ports. no packets yet, just a controller that’s officially ours. dev loop is qemu with a stick image on an emulated ehci, boot still from floppy, so the laptop only has to show up for the one hardware-specific part. moral: if the firmware won’t share the hardware, take the hardware.