The NULL EIP is desc->handle_irq in do_IRQ():
asm volatile(
" xchgl %%ebx,%%esp \n"
" call *%%edi \n"
" movl %%ebx,%%esp \n"
: "=a" (arg1), "=d" (arg2), "=c" (arg3), "=b" (ebx)
: "0" (irq), "1" (desc), "2" (regs), "3" (isp),
"D" (desc->handle_irq)
: "memory", "cc"
);
In my case, the IRQ is 0xdb = 219, which is an MSI interrupt for libata (the AHCI SATA controller, presumably). The exception happens just after the SATA driver has probed all the hard disks.
So it seems to me that the suspects are 1) sata, or 2) MSI. I'll try turning off MSI to see if it helps.