I was thinking that the Physical Upper Bound Register (ohci_11.pdf, 5.1.5) should protect against that (at least where implemented, since it's "optional"). But

I was thinking that the Physical Upper Bound Register (ohci_11.pdf, 5.1.5) should protect against that (at least where implemented, since it's "optional"). But it seems that even linux set this registers to allow pretty much everything (writes to OHCI1394_PhyUpperBound in src/drivers/firmware/*.c)