qemu-system-ppc no longer boots NetBSD/macppc

Host environment

• Operating system: Debian
• OS/kernel version: Linux gumbo 6.1.0-28-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.119-1 (2024-11-22) x86_64 GNU/Linux
• Architecture: x86_64
• QEMU flavor: qemu-system-ppc
• QEMU version: 7419dc5b and newer
• QEMU command line: qemu-system-ppc -m 256 -nographic -drive file=wd0.img,format=raw,media=disk,snapshot=on -drive file=boot.iso,format=raw,media=cdrom,readonly=on,index=2 -prom-env boot-device=cd:,netbsd-GENERIC -M mac99 -prom-env qemu_boot_hack=y

Emulated/Virtualized environment

• Operating system: NetBSD
• OS/kernel version: 10.99.12 (-current as of Dec 21, 2024)
• Architecture: macppc

Description of problem

Since commit 7419dc5b, qemu no longer boots NetBSD/macppc.

Steps to reproduce

wget https://www.gson.org/bugs/qemu/macppc-20241221/boot.iso.gz
wget https://www.gson.org/bugs/qemu/macppc-20241221/wd0.img.gz
gunzip boot.iso.gz
gunzip wd0.img.gz
qemu-system-ppc \
    -m 256 \
    -nographic \
    -drive file=wd0.img,format=raw,media=disk,snapshot=on \
    -drive file=boot.iso,format=raw,media=cdrom,readonly=on,index=2 \
    -prom-env boot-device=cd:,netbsd-GENERIC \
    -M mac99 \
    -prom-env qemu_boot_hack=y

At the "root device:" prompt, enter wd0a

At the "dump device" prompt, just press enter

At the "file system" prompt, just press enter

At the "init path" prompt, just press enter

Expected behavior: The guest system boots to a login prompt

Observed behavior: qemu exits with the following error message:

qemu: fatal: Raised an exception without defined vector 94

NIP fdb5d440   LR fdb5dc20 CTR fd62a340 XER 20000000 CPU#0
MSR 0200d032 HID0 809400a4  HF 02004012 iidx 0 didx 0
TB 00000000 831919972 DECR 105840
GPR00 0000000000000125 00000000ffffe8b0 00000000fde90008 0000000000000000
GPR04 0000000000000000 00000000fdcfebac 00000000fdcfeb48 0000000000000001
GPR08 0000000000000000 00000000fde90008 00000000ffffe8b0 00000000fdb5dc14
GPR12 0000000044004482 0000000000000000 00000000fdee0efc 00000000fdef57f0
GPR16 00000000fdef57c8 0000000000000000 00000000ffffea94 00000000ffffeac8
GPR20 00000000fdee0f3c 0000000001800114 0000000000000000 0000000000000001
GPR24 0000000000000000 00000000fdef57e0 0000000000000001 00000000fdb5da2c
GPR28 00000000ffffe9c0 00000000ffffe8f8 00000000fdcffb4c 00000000fdcfeb48
CR 24004482  [ E  G  -  -  G  G  L  E  ]     RES 004@ffffffff
FPR00 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR04 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR08 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR12 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR16 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR20 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR24 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR28 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPSCR 00000000
 SRR0 fd62a360  SRR1 0200d032    PVR 000c0209 VRSAVE 00000000
SPRG0 00c02bc0 SPRG1 44004482  SPRG2 fde90008  SPRG3 00000000
SPRG4 00000000 SPRG5 00000000  SPRG6 00000000  SPRG7 00000000
 SDR1 00e0001f   DAR cd538000  DSISR 42000000
Aborted

Additional information