That's interesting. From the whole output you posted in the pastebin, it looks as if the IDE control register is located at 0x682 and various bits of data are written between 0x600 and 0x607.
However, then something does terribly wrong mid-request and the write addresses change to 0x500-0x507 with a control register at 0x582, then 0x600-0x607 with a control register at 0x582 and then 0x700-0x707 with a control register of 0x682 again.
I'm current leaning towards this being a bug in Qemu...
So perhaps the 57 that it tries to write as an IDE CMD is getting pulled out of a memory location that the IDE code shouldn't be accessing?
-Nick
-------- This e-mail may contain confidential and privileged material for the sole use of the intended recipient. If this email is not intended for you, or you are not responsible for the delivery of this message to the intended recipient, please note that this message may contain SEAKR Engineering (SEAKR) Privileged/Proprietary Information. In such a case, you are strictly prohibited from downloading, photocopying, distributing or otherwise using this message, its contents or attachments in any way. If you have received this message in error, please notify us immediately by replying to this e-mail and delete the message from your mailbox. Information contained in this message that does not relate to the business of SEAKR is neither endorsed by nor attributable to SEAKR.