Report from pahole on amd64 host:
struct ESPState {
	SysBusDevice               busdev;               /*     0  5648 */
	/* --- cacheline 88 boundary (5632 bytes) was 16 bytes ago --- */
	uint32_t                   it_shift;             /*  5648     4 */

	/* XXX 4 bytes hole, try to pack */

	qemu_irq                   irq;                  /*  5656     8 */
	uint8_t                    rregs[16];            /*  5664    16 */
	uint8_t                    wregs[16];            /*  5680    16 */
	/* --- cacheline 89 boundary (5696 bytes) --- */
	int32_t                    ti_size;              /*  5696     4 */
	uint32_t                   ti_rptr;              /*  5700     4 */
	uint32_t                   ti_wptr;              /*  5704     4 */
	uint8_t                    ti_buf[16];           /*  5708    16 */
	uint32_t                   status;               /*  5724     4 */
	uint32_t                   dma;                  /*  5728     4 */

	/* XXX 4 bytes hole, try to pack */

	SCSIBus                    bus;                  /*  5736  2120 */
	/* --- cacheline 122 boundary (7808 bytes) was 48 bytes ago --- */
	SCSIDevice *               current_dev;          /*  7856     8 */
	SCSIRequest *              current_req;          /*  7864     8 */
	/* --- cacheline 123 boundary (7872 bytes) --- */
	uint8_t                    cmdbuf[16];           /*  7872    16 */
	uint32_t                   cmdlen;               /*  7888     4 */
	uint32_t                   do_cmd;               /*  7892     4 */
	uint32_t                   dma_left;             /*  7896     4 */
	uint32_t                   dma_counter;          /*  7900     4 */
	uint8_t *                  async_buf;            /*  7904     8 */
	uint32_t                   async_len;            /*  7912     4 */

	/* XXX 4 bytes hole, try to pack */

	ESPDMAMemoryReadWriteFunc  dma_memory_read;      /*  7920     8 */
	ESPDMAMemoryReadWriteFunc  dma_memory_write;     /*  7928     8 */
	/* --- cacheline 124 boundary (7936 bytes) --- */
	void *                     dma_opaque;           /*  7936     8 */
	int                        dma_enabled;          /*  7944     4 */

	/* XXX 4 bytes hole, try to pack */

	void                       (*dma_cb)(ESPState *); /*  7952     8 */

	/* size: 7960, cachelines: 125 */
	/* sum members: 7944, holes: 4, sum holes: 16 */
	/* last cacheline: 24 bytes */
};	/* definitions: 1 */

Fix by rearranging the structure to avoid padding.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>