OK, so sfs_ finally managed to get a good trace of a kernel panic that was happening when attempting to use webengine.
Turns out the root cause was an HMI waking up an idle thread.
Inside our opal_hmi_handler2, we were using vtophys() to set up a flags variable to have opal write the status flags.
Unfortunately, we are still running in interrupt context on an idle thread a the time, so we aren't allowed to muck with the kernel pmap.
So, instead, preallocate the flags variable in pcpu where we can just pass its DMAP address directly.