You're right, the subtraction would be required if someone were using a base address relative to the lowest mapped bus. However, the address in the MCFG table is always relative to bus zero, as I quote from the PCI firmware spec:
Quote:
For PCI-X and PCI Express platforms utilizing the enhanced
configuration access method, the base address of the memory mapped configuration space
always corresponds to bus number 0 (regardless of the start bus number decoded by the host
bridge) and further must comply with alignment requirements of the corresponding local bus
specification.
So someone would have to modify the address they read from MCFG to end up in this situation. I'll add this context to the wiki. Thanks.