IRQ_SRC is the system timer (0x02, translated to IOAPIC redirection register offset), IRQ_DST is a random global interrupt (0x3f, but every entry I tried works as expected). In theory, I can change the IRQ ACK from PIC port I/O to APIC EOI register write, and hook the IRQ_TIMER routine to 0x3f or whichever I choose, mask IRQ0 (0x20 in the global interrupt table), and it will just work.