I dug a little deeper, and defined PCKBCDEBUG in /usr/src/sys/dev/ic/pckbc.c, and it spews: pckbc_cmd: lost 0xfc
Looking at pckbc_poll_cmd1, it looks like there's an infinite loop if it doesn't get back a response it expects. What's best: specifically handling 0xfc, or erroring out on any unexpected response with "cmd->status = ENXIO; return;"? (I did the former and it works for me.)