I found that I can do
board.mb.socket_pci_conf[0].read 0 2
To read from Bus 0, Device 0, Function 0, Offset 0, 2 bytes. But I haven't been able to find the right way to encode arbitrary BDFOs. (And after offset 0x1FFF it starts saying that there's nothing mapped, so I can't simply uses a BDF * 0x1000 calculation)
I also can see things like "board.mb.nb.ioxapic" in the Object Browser, but it would be much easier if I could just specify addresses for registers exactly as described in the datasheet, instead of having to figure out how they were translated to human-named devices.