I've heard that it could address it in theory but hasn't actually been used for that yet. Do you have a source saying it does this by default, or failing that, how to set it up to do that?

IOMMU with VT-d is present, but not utilized by some major commercial operating systems and hypervisors.

There are also some implementation vulnerabilities in specific OSes which are not yet publicly disclosed.