It seems to me that the unconditional FIFO flush at the top of
ncr53c9x_select() can also participate in the race. Like the insertion
of command bytes, it can happen just after a target has succesfully
acquired the bus and one or both of the selection and message IDs
are already in the FIFO.

Now I wonder why this (apparently) isn't an issue on more chip
variants.. do these lock the FIFO against flushes as well until
the interrupt status register is read?

Anyway, can you try commenting out the NCRCMD_FLUSH command at
line 420 for a moment and see if that makes a difference?

-pk