# QEMU Version Tested with: * QEMU 8.2.x (Ubuntu 24.04 package) * QEMU 11.1.1 (self-built from upstream sources) Issue reproduces on both versions. ## Host environment - Operating system: Ubuntu 24.04 - OS/kernel version: - 6.8.0-138-generic #138-Ubuntu SMP PREEMPT_DYNAMIC Fri Jul 31 22:41:49 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux\ Architecture: x86 - QEMU flavor: qemu-system-x86_64 - QEMU version: /opt/qemu-11.1/bin/qemu-system-x86_64 --version  \ QEMU emulator version 11.1.1 \ Copyright (c) 2003-2026 Fabrice Bellard and the QEMU Project developers /usr/bin/qemu-system-x86_64 --version \ QEMU emulator version 8.2.2 (Debian 1:8.2.2+ds-0ubuntu1.18) \ Copyright (c) 2003-2023 Fabrice Bellard and the QEMU Project developers - Command line: ``` /opt/qemu-11.1/bin/qemu-system-x86_64 \ -name guest=cc-default-v0.0.64,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain-5-cc-default-v0.0.64/master-key.aes"}' \ -machine pc-q35-8.2,usb=off,vmport=off,dump-guest-core=off,memory-backend=pc.ram,hpet=off,acpi=on \ -accel kvm \ -cpu host,migratable=on,hv-time=on,hv-relaxed=on,hv-vapic=on,hv-spinlocks=0x1fff \ -m size=16384000k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":16777216000}' \ -overcommit mem-lock=off \ -smp 8,sockets=1,dies=1,cores=8,threads=1 \ -uuid 09d50c7f-ad09-4128-b5a2-07ece33f1503 \ -no-user-config \ -nodefaults \ -chardev socket,id=charmonitor,fd=41,server=on,wait=off \ -mon chardev=charmonitor,id=monitor,mode=control \ -rtc base=localtime,driftfix=slew \ -global kvm-pit.lost_tick_policy=delay \ -no-shutdown \ -global ICH9-LPC.disable_s3=1 \ -global ICH9-LPC.disable_s4=1 \ -boot strict=on \ -device '{"driver":"pcie-root-port","port":16,"chassis":1,"id":"pci.1","bus":"pcie.0","multifunction":true,"addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":8,"chassis":2,"id":"pci.2","bus":"pcie.0","multifunction":true,"addr":"0x1"}' \ -device '{"driver":"pcie-root-port","port":9,"chassis":3,"id":"pci.3","bus":"pcie.0","addr":"0x1.0x1"}' \ -device '{"driver":"pcie-root-port","port":10,"chassis":4,"id":"pci.4","bus":"pcie.0","addr":"0x1.0x2"}' \ -device '{"driver":"pcie-root-port","port":11,"chassis":5,"id":"pci.5","bus":"pcie.0","addr":"0x1.0x3"}' \ -device '{"driver":"pcie-root-port","port":12,"chassis":6,"id":"pci.6","bus":"pcie.0","addr":"0x1.0x4"}' \ -device '{"driver":"pcie-root-port","port":13,"chassis":7,"id":"pci.7","bus":"pcie.0","addr":"0x1.0x5"}' \ -device '{"driver":"pcie-root-port","port":14,"chassis":8,"id":"pci.8","bus":"pcie.0","addr":"0x1.0x6"}' \ -device '{"driver":"pcie-root-port","port":15,"chassis":9,"id":"pci.9","bus":"pcie.0","addr":"0x1.0x7"}' \ -device '{"driver":"pcie-root-port","port":17,"chassis":10,"id":"pci.10","bus":"pcie.0","addr":"0x2.0x1"}' \ -device '{"driver":"qemu-xhci","p2":15,"p3":15,"id":"usb","bus":"pci.2","addr":"0x0"}' \ -device '{"driver":"virtio-serial-pci","id":"virtio-serial0","bus":"pci.1","addr":"0x0"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/vms/cc-default-v0.0.64/../windows-v1.0.0.qcow2","node-name":"libvirt-10-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-10-format","read-only":true,"discard":"unmap","driver":"qcow2","file":"libvirt-10-storage","backing":null}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/vms/cc-default-v0.0.64/../2f8f8b1682776a0c1717ef8a6406f092.qcow2","node-name":"libvirt-9-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-9-format","read-only":true,"discard":"unmap","driver":"qcow2","file":"libvirt-9-storage","backing":"libvirt-10-format"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/vms/cc-default-v0.0.64/../00e6247d4e4a899ea8d203c4022ef012.qcow2","node-name":"libvirt-8-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-8-format","read-only":true,"discard":"unmap","driver":"qcow2","file":"libvirt-8-storage","backing":"libvirt-9-format"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/vms/cc-default-v0.0.64/../2de990e1a6ae624b1efb50d5c91007d3.qcow2","node-name":"libvirt-7-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-7-format","read-only":true,"discard":"unmap","driver":"qcow2","file":"libvirt-7-storage","backing":"libvirt-8-format"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/vms/cc-default-v0.0.64/../c2f4bc7eee5490a8a8e07c8cf7526426.qcow2","node-name":"libvirt-6-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-6-format","read-only":true,"discard":"unmap","driver":"qcow2","file":"libvirt-6-storage","backing":"libvirt-7-format"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/vms/cc-default-v0.0.64/../6b153802050d7e0a3a04dfc144768863.qcow2","node-name":"libvirt-5-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-5-format","read-only":true,"discard":"unmap","driver":"qcow2","file":"libvirt-5-storage","backing":"libvirt-6-format"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/vms/cc-default-v0.0.64/../d757fe0a2bc1ae35c9531de57cc5ee34.qcow2","node-name":"libvirt-4-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-4-format","read-only":true,"discard":"unmap","driver":"qcow2","file":"libvirt-4-storage","backing":"libvirt-5-format"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/vms/cc-default-v0.0.64/cc-default-v0.0.64.qcow2","node-name":"libvirt-3-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-3-format","read-only":false,"discard":"unmap","detect-zeroes":"unmap","driver":"qcow2","file":"libvirt-3-storage","backing":"libvirt-4-format"}' \ -device '{"driver":"ide-hd","bus":"ide.0","drive":"libvirt-3-format","id":"sata0-0-0","bootindex":2}' \ -device '{"driver":"ide-cd","bus":"ide.1","id":"sata0-0-1","bootindex":1}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/SHARE_R.img","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-1-format","read-only":true,"driver":"raw","file":"libvirt-1-storage"}' \ -device '{"driver":"usb-storage","bus":"usb.0","port":"2","drive":"libvirt-1-format","id":"usb-disk2","removable":false,"serial":"SHARE_R"}' \ -netdev '{"type":"tap","fd":"42","vhost":true,"vhostfd":"44","id":"hostnet0"}' \ -device '{"driver":"virtio-net-pci","netdev":"hostnet0","id":"net0","mac":"52:44:4d:54:54:48","bus":"pci.5","addr":"0x0"}' \ -netdev '{"type":"tap","fd":"45","vhost":true,"vhostfd":"46","id":"hostnet1"}' \ -device '{"driver":"virtio-net-pci","netdev":"hostnet1","id":"net1","mac":"52:44:4d:54:54:47","bus":"pci.6","addr":"0x0"}' \ -netdev '{"type":"tap","fd":"47","vhost":true,"vhostfd":"48","id":"hostnet2"}' \ -device '{"driver":"virtio-net-pci","netdev":"hostnet2","id":"net2","mac":"52:44:4d:54:54:49","bus":"pci.7","addr":"0x0"}' \ -netdev '{"type":"tap","fd":"49","vhost":true,"vhostfd":"50","id":"hostnet3"}' \ -device '{"driver":"virtio-net-pci","netdev":"hostnet3","id":"net3","mac":"52:44:4d:54:54:46","bus":"pci.8","addr":"0x0"}' \ -chardev pty,id=charserial0 \ -device '{"driver":"isa-serial","chardev":"charserial0","id":"serial0","index":0}' \ -chardev socket,id=charchannel0,fd=40,server=on,wait=off \ -device '{"driver":"virtserialport","bus":"virtio-serial0.0","nr":1,"chardev":"charchannel0","id":"channel0","name":"org.qemu.guest_agent.0"}' \ -device '{"driver":"usb-tablet","id":"input0","bus":"usb.0","port":"1"}' \ -audiodev '{"id":"audio1","driver":"none"}' \ -vnc 192.168.6.1:20000,audiodev=audio1 \ -device '{"driver":"virtio-vga","id":"video0","max_outputs":1,"bus":"pcie.0","addr":"0x3"}' \ -global ICH9-LPC.noreboot=off \ -watchdog-action reset \ -device '{"driver":"vfio-pci","host":"0000:02:00.0","id":"hostdev0","bus":"pci.4","addr":"0x0"}' \ -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.3","addr":"0x0"}' \ -msg timestamp=on ``` ## Emulated/Virtualized environment - Operating system: Windows 10 - OS/kernel version: <!--For POSIX guests, use `uname -a`.--> - Architecture: x86 ## Description of problem When the USB device disconnects, resets, or re-enumerates on the Linux host, QEMU crashes while removing the USB host passthrough device. The issue reproduces on both QEMU 8.2 and QEMU 11.1.1. Two different failure modes were observed: 1. Assertion failure in: `usb_packet_copy()` 2. Segmentation fault in: `usb_host_req_abort()` Both failures occur during: ``` device_del(hostdev2) qdev_unplug() usb_device_unrealize() usb_host_close() usb_host_abort_xfers() ``` which strongly suggests a race between transfer completion and device teardown. --- # Reproduction Environment contains: \-device qemu-xhci -device usb-host,vendorid=0x1a8f,productid=0x22f4 When the physical USB device disconnects/re-enumerates: ``` host device removed → libvirt issues device_del(hostdev2) → QEMU starts teardown → QEMU crashes ``` The crash occurs even when the device is disabled inside the Windows guest before the disconnect event. This suggests the issue occurs entirely on the host side in host-libusb teardown handling. This is not always happening, but from time to time. To reproduce it, I just disconnected and connected the device via virsh xml import in a loop. After 10-20 minutes the error came. First I though it had to do with windows still writing, so I disabled the device in windows, but the error still cam. --- # Failure Mode 1 Assertion failure: ``Assertion `p->actual_length + bytes <= iov->size' failed.`` Backtrace: ``` usb_packet_copy() usb_host_req_complete_data() libusb_handle_events_timeout_completed() usb_host_abort_xfers() usb_host_close() usb_device_unrealize() qdev_unplug() qmp_device_del() ``` Source: ``` ../hw/usb/core.c:623 assert(p->actual_length + bytes <= iov->size); ``` --- # Failure Mode 2 Segmentation fault. Backtrace: ``` usb_host_req_abort() usb_host_abort_xfers() usb_host_close() usb_device_unrealize() qdev_unplug() qmp_device_del() ``` From GDB: ``` #0 usb_host_req_abort (r=0x75456c607730) #1 usb_host_abort_xfers #2 usb_host_close #3 usb_device_unrealize #10 qdev_unplug #11 qmp_device_del arg = { id = "hostdev2" } ``` --- # GDB Investigation The transfer object appears valid: ``` p *r->xfer { status = LIBUSB_TRANS*ER_COMPLETED, callback = usb_hos*_req_complete_ctrl, user_data = *x75456c607730, length = 8, act*al_length = 0 } p r->x*er->status LIBUSB_TRANSFER_COMPLE*ED p r->xfer->user_dat* 0x75456c607730 ``` However, the corresponding USBPacket appears corrupted: ``` p *r->p { pid =*1814409872, id = 18105913344, *p = 0x1000, ... niov = -294506*96, ... actual_length = -67410*296, ... } ``` These values appear invalid and suggest use-after-free or memory corruption. # Interpretation Observed sequence: ``` USB device*disappears/re-enumerates ↓*device_del(hostdev2) ↓ usb*host_abort_xfers() ↓ reque*t completion / abort paths overlap* ↓ USBPacket appears corrup*ed ↓ either usb_packet_co*y() assert() or usb_host_req_abo*t() SIGSEGV ``` The crash appears related to request teardown lifetime handling. The fact that: ``` r->xfer->status == LIBUSB_TRANSFER_COMPLETED ``` while `r->p` contains corrupted values suggests a race between completed libusb transfers and destruction of associated USBPacket structures. **Expected Result** QEMU should gracefully handle: ``` USB device disconnect USB device reset USB device re-enumeration host-side hot unplug ``` without crashing the VM process. ## Additional information * Reproduced on QEMU 8.2 and 11.1.1. * Reproduced multiple times. * Windows guest activity is not required. * Disabling the device in Device Manager before disconnecting does not prevent the crash. * Crash consistently involves `hostdev2` and USB teardown paths. Dettaching command: ``` virsh detach-device cc-default-v0.0.64 --file /libvirt-images/cc-default-v0.0.64/usb-detach-1546-01a9.xml ``` file: ``` <hostdev mode='subsystem' type='usb' managed='yes'> <source> <vendor id='0x1a8f'/> <product id='0x22f5'/> <address bus='1' device='10'/> </source> </hostdev> ``` btfull on the crash with disabled windows usb devices: ``` (gdb) bt full #0 0x00005c2521ab0c7d in usb_host_req_abort (r=0x75456c607730) at ../hw/usb/host-libusb.c:509 s = 0x5c253da2f040 inflight = true s = <optimized out> inflight = <optimized out> #1 usb_host_abort_xfers (s=0x5c253da2f040) at ../hw/usb/host-libusb.c:1078 r = 0x75456c607730 rtmp = 0x75456c260940 limit = 100 #2 0x00005c2521ab223f in usb_host_close (s=0x5c253da2f040) at ../hw/usb/host-libusb.c:1112 udev = 0x5c253da2f040 #3 0x00005c25219d1da8 in usb_device_unrealize (dev=0x5c253da2f040) at ../hw/usb/bus.c:125 klass = <optimized out> #4 usb_qdev_unrealize (qdev=<optimized out>) at ../hw/usb/bus.c:291 dev = 0x5c253da2f040 s = <optimized out> next = <optimized out> #5 0x00005c2521bba34c in device_set_realized (obj=<optimized out>, value=<optimized out>, errp=<optimized out>) at ../hw/core/qdev.c:603 dev = 0x5c253da2f040 dc = <optimized out> hotplug_ctrl = <optimized out> bus = <optimized out> ncl = <optimized out> local_err = 0x0 unattached_parent = false unattached_count = 27 __func__ = "device_set_realized" __PRETTY_FUNCTION__ = "device_set_realized" #6 0x00005c2521bbca61 in property_set_bool (obj=0x5c253da2f040, v=<optimized out>, name=<optimized out>, opaque=0x5c253c43cd00, errp=0x5c25230718e8 <error_abort>) at ../qom/object.c:2484 prop = 0x5c253c43cd00 value = false #7 0x00005c2521bbfe0f in object_property_set (obj=obj@entry=0x5c253da2f040, name=name@entry=0x5c2521e766e9 "realized", v=v@entry=0x5c253c79bab0, errp=errp@entry=0x5c25230718e8 <error_abort>) at ../qom/object.c:1548 _auto_errp_prop = {local_err = 0x0, errp = 0x5c25230718e8 <error_abort>} prop = <optimized out> __func__ = "object_property_set" #8 0x00005c2521bc4053 in object_property_set_qobject (obj=obj@entry=0x5c253da2f040, name=name@entry=0x5c2521e766e9 "realized", value=value@entry=0x5c253c8cdaf0, errp=errp@entry=0x5c25230718e8 <error_abort>) at ../qom/qom-qobject.c:28 v = 0x5c253c79bab0 ok = <optimized out> #9 0x00005c2521bc0288 in object_property_set_bool (obj=0x5c253da2f040, name=0x5c2521e766e9 "realized", value=<optimized out>, errp=0x5c25230718e8 <error_abort>) at ../qom/object.c:1618 qbool = 0x5c253c8cdaf0 ok = <optimized out> _obj28 = <optimized out> __mptr = <optimized out> #10 0x00005c2521a9313e in qdev_unplug (dev=0x5c253da2f040, errp=errp@entry=0x7ffc16bdb7c8) at ../system/qdev-monitor.c:943 hotplug_ctrl = 0x754580137b78 hdc = <optimized out> local_err = 0x0 __func__ = "qdev_unplug" #11 0x00005c2521a93224 in qmp_device_del (id=<optimized out>, errp=errp@entry=0x7ffc16bdb7c8) at ../system/qdev-monitor.c:963 dev = <optimized out> __func__ = "qmp_device_del" #12 0x00005c2521d3e716 in qmp_marshal_device_del (args=<optimized out>, ret=<optimized out>, errp=0x75498087bed0) at qapi/qapi-commands-qdev.c:107 err = 0x0 ok = true v = 0x5c253d552530 arg = {id = 0x5c253d4cc0d0 "hostdev2"} --Type <RET> for more, q to quit, c to continue without paging-- _obj10 = <optimized out> __mptr = <optimized out> #13 0x00005c2521d59a0d in do_qmp_dispatch_bh (opaque=0x75498087bee0) at ../qapi/qmp-dispatch.c:128 data = 0x75498087bee0 __PRETTY_FUNCTION__ = "do_qmp_dispatch_bh" #14 0x00005c2521d7b8be in aio_bh_poll (ctx=ctx@entry=0x5c253c410a00) at ../util/async.c:220 bh = 0x5c253d618b10 flags = 11 slice = {bh_list = {slh_first = 0x0}, next = {sqe_next = 0x0}} s = <optimized out> ret = 1 #15 0x00005c2521d64611 in aio_dispatch (ctx=0x5c253c410a00) at ../util/aio-posix.c:390 ready_list = {lh_first = 0x0} #16 0x00005c2521d7b5e2 in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at ../util/async.c:365 ctx = <optimized out> __PRETTY_FUNCTION__ = "aio_ctx_dispatch" #17 0x00007549834fd585 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 #18 0x00007549834fd6d0 in g_main_context_dispatch () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 #19 0x00005c2521d7cea8 in glib_pollfds_poll () at ../util/main-loop.c:292 context = 0x5c253c43bb00 pfds = <optimized out> context = <optimized out> pfds = <optimized out> #20 os_host_main_loop_wait (timeout=0) at ../util/main-loop.c:315 context = 0x5c253c43bb00 ret = 0 context = <optimized out> ret = <optimized out> #21 main_loop_wait (nonblocking=nonblocking@entry=0) at ../util/main-loop.c:594 mlpoll = {state = 0, timeout = 4294967295, pollfds = 0x5c253c43c670} ret = <optimized out> timeout_ns = <optimized out> #22 0x00005c2521a97ee9 in qemu_main_loop () at ../system/runstate.c:950 status = <optimized out> #23 0x00005c2521cbfed0 in qemu_default_main (opaque=opaque@entry=0x0) at ../system/main.c:50 status = <optimized out> #24 0x00005c252170ca99 in main (argc=<optimized out>, argv=<optimized out>) at ../system/main.c:93 ``` bt full with enabled windows devices in windows: ``` (gdb) bt full #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44 tid = <optimized out> ret = 0 pd = <optimized out> old_mask = {__val = {128223421775808}} ret = <optimized out> pd = <optimized out> old_mask = {__val = {<optimized out>}} ret = <optimized out> tid = <optimized out> ret = <optimized out> resultvar = <optimized out> resultvar = <optimized out> __arg3 = <optimized out> __arg2 = <optimized out> __arg1 = <optimized out> _a3 = <optimized out> _a2 = <optimized out> _a1 = <optimized out> __futex = <optimized out> resultvar = <optimized out> __arg3 = <optimized out> __arg2 = <optimized out> __arg1 = <optimized out> _a3 = <optimized out> _a2 = <optimized out> _a1 = <optimized out> __futex = <optimized out> __private = <optimized out> __oldval = <optimized out> #1 __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x0000749e5904527e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 ret = <optimized out> #4 0x0000749e590288ff in __GI_abort () at ./stdlib/abort.c:79 save_stage = 1 act = {__sigaction_handler = {sa_handler = 0x20, sa_sigaction = 0x20}, sa_mask = {__val = {106256202310800, 106256182444048, 7, 140721791856768, 128223448713784, 0, 4, 50236767872, 0, 0, 18446744073709550296, 11, 106256202310784, 140721791856752, 128223447539374, 128223448941792}}, sa_flags = 1360186368, sa_restorer = 0x7ffc586a7070} #5 0x0000749e5902881b in __assert_fail_base (fmt=0x749e591d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x60a3a8decfa8 "p->actual_length + bytes <= iov->size", file=file@entry=0x60a3a8e6ad79 "../hw/usb/core.c", line=line@entry=623, function=function@entry=0x60a3a8f18300 <__PRETTY_FUNCTION__.5> "usb_packet_copy") at ./assert/assert.c:96 str = 0x60a3b331a490 "\312\017\3553\234t" total = 4096 #6 0x0000749e5903b517 in __assert_fail (assertion=assertion@entry=0x60a3a8decfa8 "p->actual_length + bytes <= iov->size", file=file@entry=0x60a3a8e6ad79 "../hw/usb/core.c", line=line@entry=623, function=function@entry=0x60a3a8f18300 <__PRETTY_FUNCTION__.5> "usb_packet_copy") at ./assert/assert.c:105 #7 0x000060a3a89c436c in usb_packet_copy (p=<optimized out>, ptr=<optimized out>, bytes=2) at ../hw/usb/core.c:623 iov = <optimized out> __PRETTY_FUNCTION__ = "usb_packet_copy" __func__ = "usb_packet_copy" #8 0x000060a3a8aa24d9 in usb_host_req_complete_data (xfer=<optimized out>) at ../hw/usb/host-libusb.c:483 r = 0x749a4b2d6b10 s = 0x60a3b2583e80 disconnect = false #9 0x0000749e59b41cf9 in ??? () at /lib/x86_64-linux-gnu/libusb-1.0.so.0 #10 0x0000749e59b4277f in ??? () at /lib/x86_64-linux-gnu/libusb-1.0.so.0 --Type <RET> for more, q to quit, c to continue without paging-- #11 0x0000749e59b42ca2 in ??? () at /lib/x86_64-linux-gnu/libusb-1.0.so.0 #12 0x0000749e59b40909 in ??? () at /lib/x86_64-linux-gnu/libusb-1.0.so.0 #13 0x0000749e59b43780 in libusb_handle_events_timeout_completed () at /lib/x86_64-linux-gnu/libusb-1.0.so.0 #14 0x000060a3a8aa1ce8 in usb_host_abort_xfers (s=0x60a3b25c7410) at ../hw/usb/host-libusb.c:1085 tv = {tv_sec = 0, tv_usec = 2500} r = <optimized out> rtmp = <optimized out> limit = <optimized out> #15 0x000060a3a8aa323f in usb_host_close (s=0x60a3b25c7410) at ../hw/usb/host-libusb.c:1112 udev = 0x60a3b25c7410 #16 0x000060a3a89c2da8 in usb_device_unrealize (dev=0x60a3b25c7410) at ../hw/usb/bus.c:125 klass = <optimized out> #17 usb_qdev_unrealize (qdev=<optimized out>) at ../hw/usb/bus.c:291 dev = 0x60a3b25c7410 s = <optimized out> next = <optimized out> #18 0x000060a3a8bab34c in device_set_realized (obj=<optimized out>, value=<optimized out>, errp=<optimized out>) at ../hw/core/qdev.c:603 dev = 0x60a3b25c7410 dc = <optimized out> hotplug_ctrl = <optimized out> bus = <optimized out> ncl = <optimized out> local_err = 0x0 unattached_parent = false unattached_count = 27 __func__ = "device_set_realized" __PRETTY_FUNCTION__ = "device_set_realized" #19 0x000060a3a8bada61 in property_set_bool (obj=0x60a3b25c7410, v=<optimized out>, name=<optimized out>, opaque=0x60a3b20fbd00, errp=0x60a3aa0628e8 <error_abort>) at ../qom/object.c:2484 prop = 0x60a3b20fbd00 value = false #20 0x000060a3a8bb0e0f in object_property_set (obj=obj@entry=0x60a3b25c7410, name=name@entry=0x60a3a8e676e9 "realized", v=v@entry=0x60a3b20e6a60, errp=errp@entry=0x60a3aa0628e8 <error_abort>) at ../qom/object.c:1548 _auto_errp_prop = {local_err = 0x0, errp = 0x60a3aa0628e8 <error_abort>} prop = <optimized out> __func__ = "object_property_set" #21 0x000060a3a8bb5053 in object_property_set_qobject (obj=obj@entry=0x60a3b25c7410, name=name@entry=0x60a3a8e676e9 "realized", value=value@entry=0x60a3b4445430, errp=errp@entry=0x60a3aa0628e8 <error_abort>) at ../qom/qom-qobject.c:28 v = 0x60a3b20e6a60 ok = <optimized out> #22 0x000060a3a8bb1288 in object_property_set_bool (obj=0x60a3b25c7410, name=0x60a3a8e676e9 "realized", value=<optimized out>, errp=0x60a3aa0628e8 <error_abort>) at ../qom/object.c:1618 qbool = 0x60a3b4445430 ok = <optimized out> _obj28 = <optimized out> __mptr = <optimized out> #23 0x000060a3a8a8413e in qdev_unplug (dev=0x60a3b25c7410, errp=errp@entry=0x7ffc586a75f8) at ../system/qdev-monitor.c:943 hotplug_ctrl = 0x749e4002db78 hdc = <optimized out> local_err = 0x0 __func__ = "qdev_unplug" #24 0x000060a3a8a84224 in qmp_device_del (id=<optimized out>, errp=errp@entry=0x7ffc586a75f8) at ../system/qdev-monitor.c:963 dev = <optimized out> __func__ = "qmp_device_del" #25 0x000060a3a8d2f716 in qmp_marshal_device_del (args=<optimized out>, ret=<optimized out>, errp=0x749e57019ed0) at qapi/qapi-commands-qdev.c:107 err = 0x0 ok = true v = 0x60a3b20e6e60 arg = {id = 0x60a3b35b0ba0 "hostdev2"} _obj10 = <optimized out> --Type <RET> for more, q to quit, c to continue without paging-- __mptr = <optimized out> #26 0x000060a3a8d4aa0d in do_qmp_dispatch_bh (opaque=0x749e57019ee0) at ../qapi/qmp-dispatch.c:128 data = 0x749e57019ee0 __PRETTY_FUNCTION__ = "do_qmp_dispatch_bh" #27 0x000060a3a8d6c8be in aio_bh_poll (ctx=ctx@entry=0x60a3b20cfa00) at ../util/async.c:220 bh = 0x60a3b258fde0 flags = 11 slice = {bh_list = {slh_first = 0x0}, next = {sqe_next = 0x0}} s = <optimized out> ret = 1 #28 0x000060a3a8d55611 in aio_dispatch (ctx=0x60a3b20cfa00) at ../util/aio-posix.c:390 ready_list = {lh_first = 0x0} #29 0x000060a3a8d6c5e2 in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at ../util/async.c:365 ctx = <optimized out> __PRETTY_FUNCTION__ = "aio_ctx_dispatch" #30 0x0000749e59c9b585 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 #31 0x0000749e59c9b6d0 in g_main_context_dispatch () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 #32 0x000060a3a8d6dea8 in glib_pollfds_poll () at ../util/main-loop.c:292 context = 0x60a3b20fab00 pfds = <optimized out> context = <optimized out> pfds = <optimized out> #33 os_host_main_loop_wait (timeout=0) at ../util/main-loop.c:315 context = 0x60a3b20fab00 ret = 0 context = <optimized out> ret = <optimized out> #34 main_loop_wait (nonblocking=nonblocking@entry=0) at ../util/main-loop.c:594 mlpoll = {state = 0, timeout = 4294967295, pollfds = 0x60a3b20fb670} ret = <optimized out> timeout_ns = <optimized out> #35 0x000060a3a8a88ee9 in qemu_main_loop () at ../system/runstate.c:950 status = <optimized out> #36 0x000060a3a8cb0ed0 in qemu_default_main (opaque=opaque@entry=0x0) at ../system/main.c:50 status = <optimized out> #37 0x000060a3a86fda99 in main (argc=<optimized out>, argv=<optimized out>) at ../system/main.c:93 ``` The error I started the journey with at the begining was just ``` syslog: 2026-09-17T03:59:22.176510+00:00 linuxhost kernel: usb 1-5.1: reset full-speed USB device number 9 using xhci_hcd 2026-09-17T03:59:22.301503+00:00 linuxhost kernel: hid-generic 0003:1A8F:22F4.0040: hiddev0,hidraw3: USB HID v1.11 Device [Harman MBCC-B Multi-trace v2.0] on usb-0000:00:14.0-5.1/input0 2026-09-17T03:59:22.301514+00:00 linuxhost kernel: cdc_acm 1-5.1:1.1: ttyACM0: USB ACM device 2026-09-17T03:59:22.305499+00:00 linuxhost kernel: cdc_acm 1-5.1:1.3: ttyACM1: USB ACM device 2026-09-17T03:59:22.308592+00:00 linuxhost kernel: cdc_acm 1-5.1:1.5: ttyACM2: USB ACM device 2026-09-17T03:59:22.308610+00:00 linuxhost kernel: cdc_acm 1-5.1:1.7: ttyACM3: USB ACM device 2026-09-17T03:59:23.461565+00:00 linuxhost kernel: qemu-system-x86[3380465]: segfault at 0 ip 00007d16e0768b9a sp 00007ffd2307cca0 error 4 in hw-usb-host.so[7d16e0767000+7000] likely on CPU 9 (core 16, socket 0) 2026-09-17T03:59:23.461575+00:00 linuxhost kernel: Code: 00 85 c0 0f 85 42 01 00 00 49 8b 46 10 b9 0e 01 00 00 4c 8d 05 4f 65 00 00 48 8d 15 ec 60 00 00 48 8d 35 f8 60 00 00 4c 89 df <80> 38 00 0f 85 9d 00 00 00 e8 b8 ef ff ff 4c 89 f6 48 89 c7 e8 4d 2026-09-17T03:59:23.539971+00:00 linuxhost libvirtd[2596]: internal error: End of file from agent socket 2026-09-17T03:59:23.605052+00:00 linuxhost libvirtd[2596]: Unable to read from monitor: Connection reset by peer 2026-09-17T03:59:23.605470+00:00 linuxhost systemd-networkd[1690]: vnet68: Link DOWN ``` <!--The line below ensures that proper tags are added to the issue. Please do not remove it.-->