Linux kernel hangs rarely when booting on the latest qemu

Host environment

• Operating system: Fedora 37, 38 and Rawhide
• OS/kernel version: 6.4.0-0.rc5.41.fc39.x86_64
• Architecture: x86-64
• QEMU flavor: qemu-system-x86_64
• QEMU version: qemu-system-x86-8.0.0-4.fc39.x86_64
• QEMU command line: Please see the log file here: https://bugzilla-attachments.redhat.com/attachment.cgi?id=1969620

Emulated/Virtualized environment

• Operating system: Linux
• OS/kernel version: 6.4.0-0.rc5.41.fc39.x86_64
• Architecture: x86_64

Description of problem

(Downstream bug: https://bugzilla.redhat.com/show_bug.cgi?id=2213346)

In Fedora we have noticed that the latest Linux kernel (rarely) hangs when booting on the latest qemu. It hangs after printing:

[    0.070120] x86/cpu: User Mode Instruction Prevention (UMIP) activated
[    0.070120] Last level iTLB entries: 4KB 512, 2MB 255, 4MB 127
[    0.070120] Last level dTLB entries: 4KB 512, 2MB 255, 4MB 127, 1GB 0
[    0.070120] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[    0.070120] Spectre V2 : Mitigation: Retpolines
[    0.070120] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch
[    0.070120] Spectre V2 : Spectre v2 / SpectreRSB : Filling RSB on VMEXIT
[    0.070120] Spectre V2 : Enabling Speculation Barrier for firmware calls
[    0.070120] RETBleed: Mitigation: untrained return thunk
[    0.070120] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier
[    0.070120] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl
[    0.070120] Freeing SMP alternatives memory: 48K

The next line which would be printed (if it didn't hang) is:

[    0.070794] smpboot: CPU0: AMD Ryzen 9 3900X 12-Core Processor (family: 0x17, model: 0x71, stepping: 0x0)

We've seen this hang on both AMD and Intel. It probably happens one in every 300 boots.

Steps to reproduce

By far the easiest way to reproduce this is to just run guestfish in a loop:

$ while guestfish -a /dev/null -v run >& /tmp/log; do echo -n . ; done 

Additional information

The full qemu command is rather long but you can find it in this log file:

https://bugzilla-attachments.redhat.com/attachment.cgi?id=1969620