When this bug occurs the guest hangs for 10 minutes. If somebody has a reproducer, then is it possible to notice the hang and connect to qemu with gdb before the BSOD to see what it's doing at that time? If qemu is looping on something then maybe we can even experiment by helping it to break out of that loop by using gdb to inject appropriate values into the test variables.