I'm not 100% sure but I think the problem is we've got two devices with the same qdev path/name and we aren't expecting that when they're children of another device; here's some debug on the aarch64 version:

(qemu) vmstate_register_with_alias_id: vmsd=cpu_common
vmstate_register_with_alias_id: se->compat=(nil) instance_id=0
vmstate_register_with_alias_id: vmsd=cpu
vmstate_register_with_alias_id: se->compat=(nil) instance_id=0
vmstate_register_with_alias_id: vmsd=pflash_cfi01
vmstate_register_with_alias_id: se->compat=(nil) instance_id=0
vmstate_register_with_alias_id: vmsd=pflash_cfi01
vmstate_register_with_alias_id: se->compat=(nil) instance_id=1
vmstate_register_with_alias_id: vmsd=arm_gic
vmstate_register_with_alias_id: se->compat=(nil) instance_id=0
vmstate_register_with_alias_id: vmsd=pl011
vmstate_register_with_alias_id: se->compat=(nil) instance_id=0
vmstate_register_with_alias_id: vmsd=pl031
vmstate_register_with_alias_id: se->compat=(nil) instance_id=0
vmstate_register_with_alias_id: vmsd=gpex_root
vmstate_register_with_alias_id: dev/id case: 0000:00:00.0
vmstate_register_with_alias_id: se->compat=0x55d911656fa0 instance_id=0
vmstate_register_with_alias_id: vmsd=PCIBUS
vmstate_register_with_alias_id: se->compat=(nil) instance_id=0
vmstate_register_with_alias_id: vmsd=pl061
vmstate_register_with_alias_id: se->compat=(nil) instance_id=0
vmstate_register_with_alias_id: vmsd=gpio-key
vmstate_register_with_alias_id: se->compat=(nil) instance_id=0
vmstate_register_with_alias_id: vmsd=fw_cfg
vmstate_register_with_alias_id: se->compat=(nil) instance_id=0
vmstate_register_with_alias_id: vmsd=scsi-disk
vmstate_register_with_alias_id: dev/id case: 0:0:0
vmstate_register_with_alias_id: se->compat=0x55d912077020 instance_id=0
vmstate_register_with_alias_id: vmsd=scsi-disk
vmstate_register_with_alias_id: dev/id case: 0:0:0
vmstate_register_with_alias_id: se->compat=0x55d912078c90 instance_id=1
qemu-system-aarch64: /home/dgilbert/git/qemu/migration/savevm.c:624: vmstate_register_with_alias_id: Assertion `!se->compat || se->instance_id == 0' failed.

I think the problem is the names of the virtio-scsi devices - on pci I'd expect to have a PCI bus name for the name of the virtio interface, so that they're pci slot/scsi id; on x86 it won't let me instantiate a virtio-scsi-device - because I don't have a virtio bus, so I have to ask for a virtio-scsi-pci device and then I end up with unique names like:

vmstate_register_with_alias_id: dev/id case: 0000:00:01.3
vmstate_register_with_alias_id: se->compat=0x564cdb891a60 instance_id=0
vmstate_register_with_alias_id: vmsd=scsi-disk
vmstate_register_with_alias_id: dev/id case: 0000:00:02.0/0:0:0
vmstate_register_with_alias_id: se->compat=0x564cdb95ec30 instance_id=0
vmstate_register_with_alias_id: vmsd=scsi-disk
vmstate_register_with_alias_id: dev/id case: 0000:00:03.0/0:0:0

going back to aarch64 and doing an info qtree we have:

  dev: virtio-mmio, id ""
    gpio-out "sysbus-irq" 1
    mmio 000000000a000800/0000000000000200
    bus: virtio-mmio-bus.4
      type virtio-mmio-bus
  dev: virtio-mmio, id ""
    gpio-out "sysbus-irq" 1
    mmio 000000000a000600/0000000000000200
    bus: virtio-mmio-bus.3
      type virtio-mmio-bus
  dev: virtio-mmio, id ""
    gpio-out "sysbus-irq" 1
    mmio 000000000a000400/0000000000000200
    bus: virtio-mmio-bus.2
      type virtio-mmio-bus
  dev: virtio-mmio, id ""
    gpio-out "sysbus-irq" 1
    mmio 000000000a000200/0000000000000200
    bus: virtio-mmio-bus.1
      type virtio-mmio-bus
  dev: virtio-mmio, id ""
    gpio-out "sysbus-irq" 1
    mmio 000000000a000000/0000000000000200
    bus: virtio-mmio-bus.0
      type virtio-mmio-bus

Dave