i386 regression in v10.2.1 -> v11.0.1
## Host environment
- Operating system: OpenBSD -curent
- OS/kernel version: `Build date: 1780513512 - Wed Jun 3 19:05:12 UTC 2026`
- Architecture: x86
- QEMU flavor: qemu-system-i386
- QEMU version: 11.0.1
- QEMU command line:
```
qemu-system-i386 -nographic -no-reboot \
-drive file=/tmp/fnstsw-boot-fails.img,format=raw,if=floppy \
-device isa-debug-exit,iobase=0xf4,iosize=0x04
```
## Emulated/Virtualized environment
- Operating system: self made boot
- OS/kernel version: irrelevant
- Architecture: x86
## Description of problem
Upgrade of QEMU from 10.2.1 to 11.0.1 leads to not working perl and who know else on OpenBSD/i386.
The issue was minimized to this reproducer:
```
.code16
.globl _start
_start:
movw $0x07c0, %ax
movw %ax, %ds
fninit
fnclex
xorw %ax, %ax
orw $1, %ax
fldl 0x40
fld1
fucompp
fnstsw %ax
sahf
seta %al
movw $0xf4, %dx
outb %al, %dx
1:
hlt
jmp 1b
.org 0x40
.double 2.0
.org 510
.word 0xaa55
```
## Steps to reproduce
1. `cc -c /tmp/fnstsw-boot-fails.S -o /tmp/fnstsw-boot-fails.o`
2. `objcopy -O binary /tmp/fnstsw-boot-fails.o /tmp/fnstsw-boot-fails.img`
3. `qemu-system-i386 -nographic -no-reboot -drive file=/tmp/fnstsw-boot-fails.img,format=raw,if=floppy -device isa-debug-exit,iobase=0xf4,iosize=0x04`
on 10.2.1 it exits with `1` which is expected, on 11.0.1 with `3`
## Additional information
Relevant mail list thread: https://marc.info/?t=178082576900001&r=1&w=2
And replacing `fnstsw` to `fstsw` in reproducer allows to overstep bug.
issue