Jacques found that the Trump Card ports are not mapped as found in the Byte magazine. 

It uses 3EB, 3ED and 3EF instead of 3E8, 3EC and 3EE.

      98 7654 32 10 <-- PCbus address bit

3E8 = 11 1110 10 00    From LDZSYS.CO
3EC = 11 1110 11 00
3EE = 11 1110 11 10

3EB = 11 1110 10 11    From Byte magazine text
3ED = 11 1110 11 01
3EF = 11 1110 11 11

The magazine article says:

"The 8088 selects the bucket when it performs either an /IOW (I/O write) or /IOR (I/O read) in the range of the IBM's regular memory-address space from hexadecimal 03E8 to 03EE. Accesses to these addresses are decoded by IC28 to generate the Trump Card's /PCSEL signal."

Looking at IC28 (a 74LS133) in the circuit (page 48 of the Byte article), we can see it detects the PC bus address 0x3EC. IC31 and 32 (page 49) clear or increment the counters.

98 7654 32 10 <-- PCbus address bit
11 1110 1x xx IC28 decodes 3E8 to 3EF
11 1110 1x 1x IC31 decodes 3E8,3E9,3EC,3ED to clear counters (write)
11 1110 1x 1x IC32 decodes 3E8,3E9,3EC,3ED to increment counters

IC32 asserts the increment signal whether reading or writing, but the clearing when writing will override the increment.

So the article words and circuit are consistent.

PC address line 0 is ignored, so 3EE = 3EF and 3EC = 3ED in action.

3E8 and 3EB differ in A0 (harmlessly) but also A1.

Looking at IC9 on page 49, we can see that reset is assert when PC address line A2 is low.

Which means any address from 3E8 to 3EB.

So, mystery solved. The firmware is not wrong, it just uses different 'don't care. bits.