"but as I recall it also never happens until at least one suspend/resume"

Until today.  Sigh.  Nevermind.

May 13 16:38:45 aethereal kernel: [28098.589766] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
May 13 16:38:45 aethereal kernel: [28098.589774] IP: [<ffffffffa03e88a0>] gfn_to_rmap+0x50/0x70 [kvm]
May 13 16:38:45 aethereal kernel: [28098.589797] PGD cddd7067 PUD d98bc067 PMD 0
May 13 16:38:45 aethereal kernel: [28098.589802] Oops: 0000 [#1] SMP
May 13 16:38:45 aethereal kernel: [28098.589806] last sysfs file: /sys/devices/pci0000:00/0000:00:1c.1/0000:0c:00.0/rfkill/rfkill0/state
May 13 16:38:45 aethereal kernel: [28098.589810] Dumping ftrace buffer:
May 13 16:38:45 aethereal kernel: [28098.589813]    (ftrace buffer empty)
May 13 16:38:45 aethereal kernel: [28098.589814] CPU 0
May 13 16:38:45 aethereal kernel: [28098.589817] Modules linked in: binfmt_misc i915 drm ppdev bridge stp bnep input_polldev kvm_intel kvm snd_hwdep sbp2 lp parport snd_hda_intel snd_pcm_oss
 snd_mixer_oss arc4 snd_pcm ecb pata_pcmcia snd_seq_dummy snd_seq_oss iwlagn iwlcore snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq led_class pcmcia snd_timer snd_seq_device mac80211 sn
d soundcore yenta_socket rsrc_nonstatic pcmcia_core iTCO_wdt iTCO_vendor_support snd_page_alloc psmouse btusb cfg80211 dcdbas pcspkr serio_raw joydev sha256_generic aes_x86_64 aes_generic cb
c dm_crypt fbcon tileblit font bitblit softcursor squashfs unionfs nls_iso8859_1 nls_cp437 vfat fat usbhid usb_storage ohci1394 ieee1394 tg3 video output intel_agp
May 13 16:38:45 aethereal kernel: [28098.589879] Pid: 6963, comm: kvm Not tainted 2.6.28-11-generic #42-Ubuntu
May 13 16:38:45 aethereal kernel: [28098.589881] RIP: 0010:[<ffffffffa03e88a0>]  [<ffffffffa03e88a0>] gfn_to_rmap+0x50/0x70 [kvm]
May 13 16:38:45 aethereal kernel: [28098.589895] RSP: 0018:ffff8800b3887bd8  EFLAGS: 00010246
May 13 16:38:45 aethereal kernel: [28098.589897] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
May 13 16:38:45 aethereal kernel: [28098.589899] RDX: 00000000000fee01 RSI: 0000000000000022 RDI: fffffffffffff001
May 13 16:38:45 aethereal kernel: [28098.589902] RBP: ffff8800b3887be8 R08: 0000000000000022 R09: 0000000000000000
May 13 16:38:45 aethereal kernel: [28098.589904] R10: 0000000000000002 R11: 0000000000000000 R12: fffffffffffff001
May 13 16:38:45 aethereal kernel: [28098.589906] R13: ffff880013087420 R14: ffff8800c2508000 R15: 0000000000000000
May 13 16:38:45 aethereal kernel: [28098.589909] FS:  0000000000000000(0000) GS:ffffffff80aa3000(0000) knlGS:0000000000000000
May 13 16:38:45 aethereal kernel: [28098.589912] CS:  0010 DS: 002b ES: 002b CR0: 000000008005003b
May 13 16:38:45 aethereal kernel: [28098.589914] CR2: 0000000000000000 CR3: 00000000bb89d000 CR4: 00000000000026a0
May 13 16:38:45 aethereal kernel: [28098.589916] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
May 13 16:38:45 aethereal kernel: [28098.589919] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
May 13 16:38:45 aethereal kernel: [28098.589922] Process kvm (pid: 6963, threadinfo ffff8800b3886000, task ffff8800b89d0000)
May 13 16:38:45 aethereal kernel: [28098.589924] Stack:
May 13 16:38:45 aethereal kernel: [28098.589926]  000000e53afbe42b ffff88011b5a2000 ffff8800b3887c18 ffffffffa03e8965
May 13 16:38:45 aethereal kernel: [28098.589930]  ffff88011b5a2000 0000000000000000 ffff880013087420 ffff8800c2508000
May 13 16:38:45 aethereal kernel: [28098.589935]  ffff8800b3887c58 ffffffffa03e8ea0 0000000000100100 ffff88011dcbcd10
May 13 16:38:45 aethereal kernel: [28098.589940] Call Trace:
May 13 16:38:45 aethereal kernel: [28098.589943]  [<ffffffffa03e8965>] rmap_remove+0xa5/0x230 [kvm]
May 13 16:38:45 aethereal kernel: [28098.589955]  [<ffffffffa03e8ea0>] kvm_mmu_zap_page+0xf0/0x330 [kvm]
May 13 16:38:45 aethereal kernel: [28098.589968]  [<ffffffffa03e9583>] kvm_mmu_zap_all+0x43/0x80 [kvm]
May 13 16:38:45 aethereal kernel: [28098.589981]  [<ffffffffa03e0419>] kvm_arch_flush_shadow+0x9/0x10 [kvm]
May 13 16:38:45 aethereal kernel: [28098.589994]  [<ffffffffa03dce20>] kvm_mmu_notifier_release+0x10/0x20 [kvm]
May 13 16:38:45 aethereal kernel: [28098.590006]  [<ffffffff802de35b>] __mmu_notifier_release+0xab/0xb0
May 13 16:38:45 aethereal kernel: [28098.590015]  [<ffffffff802c94a7>] exit_mmap+0x27/0x170
May 13 16:38:45 aethereal kernel: [28098.590020]  [<ffffffff8024eaf8>] mmput+0x38/0xd0
May 13 16:38:45 aethereal kernel: [28098.590024]  [<ffffffff80252f56>] exit_mm+0x116/0x150
May 13 16:38:45 aethereal kernel: [28098.590029]  [<ffffffff8069e471>] ? _spin_lock_irq+0x11/0x20
May 13 16:38:45 aethereal kernel: [28098.590034]  [<ffffffff80254f0c>] do_exit+0x16c/0x3b0
May 13 16:38:45 aethereal kernel: [28098.590038]  [<ffffffff80255192>] do_group_exit+0x42/0xc0
May 13 16:38:45 aethereal kernel: [28098.590041]  [<ffffffff802607ac>] get_signal_to_deliver+0x1ac/0x3a0
May 13 16:38:45 aethereal kernel: [28098.590046]  [<ffffffff80212625>] ? sysret_signal+0x3d/0x67
May 13 16:38:45 aethereal kernel: [28098.590050]  [<ffffffff80212230>] do_signal+0x70/0x1e0
May 13 16:38:45 aethereal kernel: [28098.590054]  [<ffffffff80268930>] ? autoremove_wake_function+0x0/0x40
May 13 16:38:45 aethereal kernel: [28098.590059]  [<ffffffff80270969>] ? getnstimeofday+0x59/0xe0
May 13 16:38:45 aethereal kernel: [28098.590063]  [<ffffffff8026c659>] ? ktime_get_ts+0x59/0x60
May 13 16:38:45 aethereal kernel: [28098.590067]  [<ffffffff802f77d0>] ? poll_select_set_timeout+0x80/0x90
May 13 16:38:45 aethereal kernel: [28098.590072]  [<ffffffff80212625>] ? sysret_signal+0x3d/0x67
May 13 16:38:45 aethereal kernel: [28098.590075]  [<ffffffff802123dd>] do_notify_resume+0x3d/0x40
May 13 16:38:45 aethereal kernel: [28098.590079]  [<ffffffff802129c7>] ptregscall_common+0x67/0xb0
May 13 16:38:45 aethereal kernel: [28098.590082] Code: 4c 89 e2 48 c1 ea 09 48 c1 e8 09 48 29 c2 48 c1 e2 04 48 03 51 28 48 89 d0 48 8b 1c 24 4c 8b 64 24 08 c9 c3 0f 1f 80 00 00 00 00 <4c> 2b 20 4a 8d 14 e5 00 00 00 00 48 03 50 18 eb da 66 66 66 66
May 13 16:38:45 aethereal kernel: [28098.590122] RIP  [<ffffffffa03e88a0>] gfn_to_rmap+0x50/0x70 [kvm]
May 13 16:38:45 aethereal kernel: [28098.590135]  RSP <ffff8800b3887bd8>
May 13 16:38:45 aethereal kernel: [28098.590137] CR2: 0000000000000000
May 13 16:38:45 aethereal kernel: [28098.590152] ---[ end trace 647f64ade2451d4b ]---
May 13 16:38:45 aethereal kernel: [28098.590155] Fixing recursive fault but reboot is needed!