You can use the ExpMgrConfigReadWord function to read the word value at a specific address in PCI configuration space.
OSErr ExpMgrConfigReadWord (
RegEntryIDPtr node,
LogicalAddress configAddr,
UInt16 *valuePtr);
The ExpMgrConfigReadWord function reads the word at the address in PCI configuration space for device node node determined by offset configAddr, returning its byte-swapped value in valuePtr.