<!-- This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, please consult https://www.qemu.org/contribute/security-process/ --> ## Host environment - Operating system: macOS 26.5.1 - OS/kernel version: Darwin Kernel Version 25.5.0: Mon Apr 27 20:38:56 PDT 2026; root:xnu-12377.121.6~2/RELEASE_ARM64_T6000 arm64 arm Darwin - Architecture: ARM - QEMU flavor: emu-aarch64 - QEMU version: 11.0.0+ - QEMU command line: ``` ./qemu-system-aarch64 -M virt -cpu host -accel hvf -m 1G -monitor stdio -display none ``` ## Emulated/Virtualized environment - Operating system: Linux (NixOS), any? - OS/kernel version: Linux nixos 6.18.34 #1-NixOS SMP PREEMPT Mon Jun 1 15:51:08 UTC 2026 aarch64 GNU/Linux - Architecture: ARM ## Description of problem I have set up a Linux VM working as a remote builder for Nix on my macOS machine and I noticed it stopped working recently. When troubleshooting I noticed that with `qemu` v11+ the remote builder service was on a crash loop, exiting with code 134, with the error some failed assertion in the function `hvf_arch_init_vcpu`. I [reported the issue to Nixpkgs](https://github.com/NixOS/nixpkgs/issues/528299) (if you use Nix you can use the instructions on the first reply to reproduce) but investigating further I seem to reproduce this on `qemu`'s codebase, though the error happens in the same function it is a bit different. This is the error when I build the program with `CFLAGS='-g -O1' ../configure --target-list=aarch64-softmmu --enable-debug --disable-werror --disable-docs && make`. ``` QEMU 11.0.50 monitor - type 'help' for more information Assertion failed: (!(ri->type & ARM_CP_NO_RAW)), function hvf_arch_init_vcpu, file hvf.c, line 1442. ./bisect-hvf-test.sh: line 72: 25506 Abort trap: 6 ``` Given the errors are a bit different I'm not sure if I'm conflating different issues. I apologise in advance for any misdirection I might be introducing. ## Steps to reproduce I attach a script used with `git bisect master v10.2.2` that reproduces the problem and has helped me locate the commit that introduces it (`[887eaa8a29019082a68a0389abbfddd21a6d5bb7] target/arm: implement FEAT_RNG_TRAP for RNDR/RNDRRS`), though I'm not knowledgeable on the codebase to see how it's related to the failed assertion. I also attach the `git bisect log` output in case it's useful. [bisect-hvf-test.sh](/uploads/9a250c7df4d58de7293519a307c947da/bisect-hvf-test.sh) [bisect.log](/uploads/369fbe54c5065bcaaffb9cf440306d2b/bisect.log) ## Additional information N/A <!-- Attach logs, stack traces, screenshots, etc. Compress the files if necessary. If using libvirt, libvirt logs and XML domain information may be relevant. --> <!-- The line below ensures that proper tags are added to the issue. Please do not remove it. -->