It is indeed possible for the pass FIFO to have more than the tag FIFO. If
the TX mux is blocked after popping the tag, but before popping the pass
FIFO, the pass FIFO can have one more element.  Thus, if you have all of the
pending tags landing in the same FIFO (pass, wbm, cfg), you can end up with
the situation where the tag FIFO is indeed less full and thus you refill the
tag FIFO while overflowing the other FIFOs.

The result of this bug is that when writing to slow slaves, a very homogeneous
access pattern can end up with a corrupted word if you are unlucky.

The worst part of this bug is that when I wrote that code, I was uncertain
if this was safe and marked it to be reviewed.  It never got reviewed. Doh.