vdup.32 qX, rX produces an incorrect result

Host environment

• Operating system: NixOS
• OS/kernel version: Linux 6.12.28 #1-NixOS SMP PREEMPT_DYNAMIC Fri May 9 07:50:53 UTC 2025 x86_64 GNU/Linux
• Architecture: x86_64
• QEMU flavor: qemu-arm
• QEMU version: 9.2.3
• QEMU command line:

  qemu-arm a.out

Emulated/Virtualized environment

• Operating system: Linux user mode
• OS/kernel version: N/A
• Architecture: Arm

Description of problem

On an Arm guest, vdup.32 qX, rX sets qX to {rX, 0, rX, 0} instead of {rX, rX, rX, rX} under limited circumstances. vdup.8 and vdup.16 exhibit the same problem.

Steps to reproduce

Compile the attached assembly code reprod.S and run it by qemu-arm. It executes the following code fragment and checks the result.

movs r4, #42
moveq r4, #42
vdup.32 q1, r4
mov r4, #0

The program fails when running under qemu-arm:

$ clang --target=armv7a-linux-gnueabi -nostdlib -fuse-ld=lld reprod.S
$ qemu-arm a.out || echo "qemu-arm exited with status $?"
qemu-arm exited with status 1

Running with -d cpu shows q1 is set to {42, 0, 42, 0}, not the correct value {42, 42, 42, 42} (underline added):

$ qemu-arm -d cpu a.out 2>&1 | tail -5
R00=0000002a R01=00000000 R02=0000002a R03=00000000
    ^^^^^^^^     ^^^^^^^^     ^^^^^^^^     ^^^^^^^^ 
R04=00000000 R05=00000000 R06=00000000 R07=00000000
R08=00000000 R09=00000000 R10=00420198 R11=00000000
R12=00000000 R13=407fd600 R14=00000000 R15=0041018c
PSR=80000010 N--- A usr32

The program runs successfully if -one-insn-per-tb is provided:

$ qemu-arm -one-insn-per-tb a.out || echo "qemu-arm exited with status $?"

Additional information