I think kib's point here is that this will break machines that work with an IOMMU today. They will have io_cpu > IOAPIC_MAX_ID, but will have a valid low. Your test here is insufficient.

I think instead we need to add a new bool (or just another 1-bit field after io_masked) which is something like io_valid. It should be cleared to 0 in both your new case below, and in the IOMMU case in ioapic_program_intpin when remapping fails with an error other than EOPNOTSUPP. I would probably add an invalid: label at the bottom of ioapic_program_intpin` that clears this field and just sets the mask bit similar to what happens now for the IRQ_DISABLED case. Then enable_source can instead do this:

if (intpin->io_masked && intpio->io_valid)

I would also check the valid flag in ioapic_disable_source as well probably.

Oh, whoops. I forgot that the >255 check was only relevant when when we hit the IOMMU EOPNOTSUPP case. Yeah, sounds like we need a new io_valid flag, I'll get to work on that.