Segfault when hibernating a KVM VM with QEMU 8.2.3

Host environment

• Operating system: NixOS unstable
• OS/kernel version: 6.8.8
• Architecture: x86_64
• QEMU flavor: qemu-system-x86_64
• QEMU version: 8.2.3
• QEMU command line: (sorry this is long)

-cpu max 
-name machine
-m 1024
-smp 1
-device virtio-rng-pci
-net nic,netdev=user.0,model=virtio
-netdev user,id=user.0,
-virtfs local,path=/tmp/shared-xchg,security_model=none,mount_tag=shared
-virtfs local,path=/tmp/vm-state-machine/xchg,security_model=none,mount_tag=xchg
-drive cache=writeback,file=/tmp/vm-state-machine/machine.qcow2,id=drive1,if=none,index=1,werror=report
-device virtio-blk-pci,bootindex=1,drive=drive1,serial=root
-drive file=/tmp/vm-state-machine/store.img,format=raw,id=drive2,if=none,index=2
-device virtio-blk-pci,bootindex=2,drive=drive2
-drive file=/tmp/vm-state-machine/empty0.qcow2,id=drive3,if=none,index=3,werror=report
-device virtio-blk-pci,drive=drive3
-device virtio-net-pci,netdev=vlan1,mac=52:54:00:12:01:01
-netdev vde,id=vlan1,sock=/tmp/vde1.ctl
-device virtio-keyboard
-usb
-device usb-tablet,bus=usb-bus.0
-kernel /nix/store/dvvazm7cz0i52sqdmpzf704j9ynf6rav-nixos-system-machine-test/kernel 
-initrd /nix/store/lzkkh7sd48igv5ag075glvi42iwmxfmx-initrd-linux-6.6.29/initrd
-append "console=ttyS0 panic=1 boot.panic_on_fail clocksource=acpi_pm loglevel=7 net.ifnames=0 init=/nix/store/dvvazm7cz0i52sqdmpzf704j9ynf6rav-nixos-system-machine-test/init regInfo=/nix/store/n04bx6mbks3ihaq4xhxli1289pdgxhcs-closure-info/registration console=ttyS0"
-drive if=pflash,format=raw,unit=0,readonly=on,file=/nix/store/0wbr8qhmbddqd419hfapj3pkzn71xrq1-OVMF-202402-fd/FV/OVMF_CODE.fd
-drive if=pflash,format=raw,unit=1,readonly=off,file=/tmp/vm-state-machine/machine-efi-vars.fd
-qmp unix:/tmp/vm-state-machine/qmp,server=on,wait=off
-monitor unix:/tmp/vm-state-machine/monitor
-chardev socket,id=shell,path=/tmp/vm-state-machine/shell
-device virtio-serial
-device virtconsole,chardev=shell
-device virtio-rng-pci
-serial stdio
-no-reboot

Emulated/Virtualized environment

• Operating system: NixOS unstable
• OS/kernel version: 6.6.29
• Architecture: x86_64

Description of problem

Attempting to hibernate the machine crashes QEMU.

Steps to reproduce

This involves Nix, please tell me if you want a reproducer that doesn't.

1. nix build github:NixOS/nixpkgs#nixosTests.hibernate.driver
2. ./result/bin/nixos-test-driver
3. Observe crash

Additional information

Backtrace:

#0  kvm_virtio_pci_vq_vector_release (proxy=0x55bd979fd130, vector=<optimized out>) at ../hw/virtio/virtio-pci.c:834
#1  kvm_virtio_pci_vector_release_one (proxy=proxy@entry=0x55bd979fd130, queue_no=queue_no@entry=0) at ../hw/virtio/virtio-pci.c:965
#2  0x000055bd9380c430 in virtio_pci_set_vector (vdev=0x55bd97a05500, proxy=0x55bd979fd130, queue_no=0, old_vector=1, new_vector=65535)
    at ../hw/virtio/virtio-pci.c:1445
#3  0x000055bd939c5490 in memory_region_write_accessor (mr=0x55bd979fdc70, addr=26, value=<optimized out>, size=2, shift=<optimized out>, 
    mask=<optimized out>, attrs=...) at ../system/memory.c:497
#4  0x000055bd939c4d56 in access_with_adjusted_size (addr=addr@entry=26, value=value@entry=0x7ff49d1ff3e8, size=size@entry=2, 
    access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=0x55bd939c5410 <memory_region_write_accessor>, mr=<optimized out>, 
    attrs=...) at ../system/memory.c:573
#5  0x000055bd939c5081 in memory_region_dispatch_write (mr=mr@entry=0x55bd979fdc70, addr=addr@entry=26, data=<optimized out>, op=<optimized out>, 
    attrs=attrs@entry=...) at ../system/memory.c:1528
#6  0x000055bd939ccb0c in flatview_write_continue (fv=fv@entry=0x7ff4445771c0, addr=addr@entry=61572651286554, attrs=..., attrs@entry=..., 
    ptr=ptr@entry=0x7ff4a082d028, len=len@entry=2, addr1=<optimized out>, l=<optimized out>, mr=0x55bd979fdc70) at ../system/physmem.c:2714
#7  0x000055bd939ccd83 in flatview_write (fv=0x7ff4445771c0, addr=addr@entry=61572651286554, attrs=attrs@entry=..., buf=buf@entry=0x7ff4a082d028, 
    len=len@entry=2) at ../system/physmem.c:2756
#8  0x000055bd939d0099 in address_space_write (len=2, buf=0x7ff4a082d028, attrs=..., addr=61572651286554, as=0x55bd94a4e720 <address_space_memory>)
    at ../system/physmem.c:2863
#9  address_space_rw (as=0x55bd94a4e720 <address_space_memory>, addr=61572651286554, attrs=attrs@entry=..., buf=buf@entry=0x7ff4a082d028, len=2, 
    is_write=<optimized out>) at ../system/physmem.c:2873
#10 0x000055bd93a24548 in kvm_cpu_exec (cpu=cpu@entry=0x55bd9628a3e0) at ../accel/kvm/kvm-all.c:2915
#11 0x000055bd93a25795 in kvm_vcpu_thread_fn (arg=arg@entry=0x55bd9628a3e0) at ../accel/kvm/kvm-accel-ops.c:51
#12 0x000055bd93bb5fa8 in qemu_thread_start (args=0x55bd96294940) at ../util/qemu-thread-posix.c:541
#13 0x00007ff4a19fd272 in start_thread (arg=<optimized out>) at pthread_create.c:447
#14 0x00007ff4a1a78dcc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Bisected to fcbb086a, reverting that change seems to make things work again.