Comment 3 for bug 1706058

To confirm the issue described in the original fix, I traced the virtio balloon subsystem (using QEMU simpletracing) while the VM:

1.) Loaded from a QEMUFile
virtio_set_status 0.000 pid=6248 vdev=0x55dcc49cf968 val=0x0
balloon_event 31433104.748 pid=6248 opaque=0x55dcc49cf968 addr=0x100000000
virtio_balloon_to_target 341.343 pid=6248 target=0x100000000 num_pages=0x0
virtio_set_status 5017492.910 pid=6248 vdev=0x55dcc49cf968 val=0x7
# Driver negotiation finished; running balloon_stats_cb() -> virtqueue_push()
virtqueue_fill 16176215.480 pid=6248 vq=0x55dcc4a4c9b0 elem=0x55dcc49cfa98 len=0x0 idx=0x0
virtqueue_flush 6.821 pid=6248 vq=0x55dcc4a4c9b0 count=0x1
virtqueue_flush_vt 2.050 pid=6248 old=0xc4 new=0xc5 inuse=0x1
virtio_notify 1.380 pid=6248 vdev=0x55dcc49cf968 vq=0x55dcc4a4c9b0

Here stats_vq_offset is 0 and elem->index is invalid, making the guest BSOD.

2.) Booted normally
...
virtio_set_status 0.754 pid=1133 vdev=0x55c2aec27888 val=0x0
virtio_set_status 21.646 pid=1133 vdev=0x55c2aec27888 val=0x3
virtio_set_status 297.769 pid=1133 vdev=0x55c2aec27888 val=0x7
virtio_queue_notify 20.924 pid=1133 vdev=0x55c2aec27888 n=0x2 vq=0x55c2ae39cb60
virtqueue_pop 29.931 pid=1133 vq=0x55c2ae39cb60 elem=0x55c2aec279b8 in_num=0x0 out_num=0x1
virtio_balloon_get_config 357.561 pid=1133 num_pages=0x0 acutal=0x0
virtio_balloon_get_config 10.239 pid=1133 num_pages=0x0 acutal=0x0
virtio_balloon_get_config 2.862 pid=1133 num_pages=0x0 acutal=0x0
virtio_balloon_get_config 2.761 pid=1133 num_pages=0x0 acutal=0x0
virtio_balloon_set_config 171.747 pid=1133 acutal=0x0 oldacutal=0x0
virtio_balloon_set_config 135.158 pid=1133 acutal=0x0 oldacutal=0x0
virtio_balloon_set_config 103.806 pid=1133 acutal=0x0 oldacutal=0x0
virtio_balloon_set_config 95.435 pid=1133 acutal=0x0 oldacutal=0x0
# Driver negotiation finished; running balloon_stats_cb() -> virtqueue_push()
virtqueue_fill 24115244.041 pid=1133 vq=0x55c2ae39cb60 elem=0x55c2aec279b8 len=0x3c idx=0x0
virtqueue_flush 7.069 pid=1133 vq=0x55c2ae39cb60 count=0x1
virtqueue_lol 1.712 pid=1133 old=0x0 new=0x1 inuse=0x1
virtio_notify 1.120 pid=1133 vdev=0x55c2aec27888 vq=0x55c2ae39cb60
virtio_queue_notify 1907.429 pid=1133 vdev=0x55c2aec27888 n=0x2 vq=0x55c2ae39cb60
virtqueue_pop 9.840 pid=1133 vq=0x55c2ae39cb60 elem=0x55c2aec279b8 in_num=0x0 out_num=0x1
...

Here stats_vq_offset is 0x3c (the size of stats_vq_elem), and the request proceeds without problem.

I'm currently working on the SRU