Segfault when saving VM snapshot via QEMU monitor on MIPS and MIPSEL

Host environment

• Operating system: Arch Linux
• OS/kernel version: 5.17.3
• Architecture: x86_64
• QEMU flavor: qemu-system-mips, qemu-system-mipsel
• QEMU version: 7.0.0rc4, commit hash 81c7ed41a1b33031f3e4fe24191a998a492044b8
• QEMU command line:

  qemu-system-mips \
   -M malta -cpu mips32r6-generic \
   -kernel kernel.img \
   -drive file=rootfs.qcow2,format=qcow2 \
   -append "rootwait root=/dev/sda quiet" \
   -nographic  -serial mon:stdio

Emulated/Virtualized environment

• Operating system: Linux (Buildroot)
• OS/kernel version: 5.15.18
• Architecture: MIPS and MIPSEL

Description of problem

When entering the QEMU monitor using Ctrl-A then C, and running the savevm QEMU command, the emulator hangs for a while and then exits with a segfault. This occurs on MIPS and MIPSEL system emulators using the same command line arguments. ARM32, aarch64 and x86_64 emulators don't seem to have this problem. I haven't tested it on any other architectures as I don't have kernel or drive images for them. qemu-img seems to work fine with the QCOW2 images used for this test, I was able to create and load offline snapshots from them. The images were created from raw EXT2 filesystem images produced by Buildroot, using qemu-img convert.

Steps to reproduce

1. Start the QEMU system emulator for MIPS/MIPSEL with the given command line.
2. Enter the QEMU monitor with Ctrl-A, C.
3. Run savevm <vm name>.

Additional information

I tried logging what QEMU was doing with the -D ./log.txt command line option, but the produced log file was empty.

If you need me to send you the kernel image files and QCOW2 images used, I would be happy to do so.