so that if the drop to spl0() causes another panic (e.g. because there's still some fatal hardware interrupt that's pending) we'll know that we dropped IPL to sync the disks.