does this help?
http://brewweb.devel.redhat.com/brew/taskinfo?taskID=10174897

I've applied Michael's patch (https://lists.nongnu.org/archive/html/qemu-devel/2015-12/msg00164.html) to git://git.app.eng.bos.redhat.com/virt/rhel7/qemu-kvm.git (tag: qemu-kvm-rhev-2.3.0-31.el7_2.3).

And the issue seems to be fixed.
Here is the new Memory Table sent to vubr:

==================   Vhost user message from QEMU   ==================
Request: VHOST_USER_SET_MEM_TABLE (5)
Flags:   0x1
Size:    264
Fds: 10 11 12 13 14 15 16 17
Nregions: 8
Region 0
    guest_phys_addr: 0x0000000040000000
    memory_size:     0x0000000040000000
    userspace_addr   0x00002aab00000000
    mmap_offset      0x0000000000000000
    mmap_addr:       0x00002aaac0000000
Region 1
    guest_phys_addr: 0x0000000000000000
    memory_size:     0x00000000000a0000
    userspace_addr   0x00002aaac0000000
    mmap_offset      0x0000000000000000
    mmap_addr:       0x00002aab00000000
Region 2
    guest_phys_addr: 0x00000000000c0000
    memory_size:     0x000000000000b000
    userspace_addr   0x00002aaac00c0000
    mmap_offset      0x00000000000c0000
    mmap_addr:       0x00002aab40000000
Region 3
    guest_phys_addr: 0x00000000000cb000
    memory_size:     0x0000000000003000
    userspace_addr   0x00002aaac00cb000
    mmap_offset      0x00000000000cb000
    mmap_addr:       0x00002aab80000000
Region 4
    guest_phys_addr: 0x00000000000ce000
    memory_size:     0x000000000001e000
    userspace_addr   0x00002aaac00ce000
    mmap_offset      0x00000000000ce000
    mmap_addr:       0x00002aabc0000000
Region 5
    guest_phys_addr: 0x00000000000ec000
    memory_size:     0x0000000000004000
    userspace_addr   0x00002aaac00ec000
    mmap_offset      0x00000000000ec000
    mmap_addr:       0x00002aac00000000
Region 6
    guest_phys_addr: 0x00000000000f0000
    memory_size:     0x0000000000010000
    userspace_addr   0x00002aaac00f0000
    mmap_offset      0x00000000000f0000
    mmap_addr:       0x00002aac40000000
Region 7
    guest_phys_addr: 0x0000000000100000
    memory_size:     0x000000003ff00000
    userspace_addr   0x00002aaac0100000
    mmap_offset      0x0000000000100000
    mmap_addr:       0x00002aac80000000
==========================================================

qemu activation:
----------------

NUM=1

${WORK_DIR}/qemu-kvm/bin/x86_64-softmmu/qemu-system-x86_64 \
    -snapshot \
    -enable-kvm -m 2048 -smp 2 \
    -chardev socket,id=char0,path=/tmp/vubr${NUM}.sock \
    -netdev type=vhost-user,id=mynet1,chardev=char0,vhostforce \
    -device virtio-net-pci,netdev=mynet1,mac=52:54:00:02:d9:0$NUM \
    -object memory-backend-file,id=mem,size=1024M,mem-path=/dev/hugepages,share=on \
    -numa node,nodeid=0,memdev=mem -mem-prealloc \
    -object memory-backend-file,id=mem1,size=1024M,mem-path=/dev/hugepages,share=on \
    -numa node,nodeid=1,memdev=mem1 -mem-prealloc \
    -net user,hostfwd=tcp::1002$NUM-:22,net=10.2.2.0/24 -net nic \
    /root/fedora-infiniband.qcow2

-- Victor

Hi Xiangchun,

This is RHEL7.3 bz but you are using RHEL7.2.z build. Remove the needinfo.

Best Regards,
Junyi

This bug was accidentally moved from POST to MODIFIED via an error in automation, please see mmccune with any questions

*** Bug 1297748 has been marked as a duplicate of this bug. ***

*** Bug 1290063 has been marked as a duplicate of this bug. ***

*** Bug 1290065 has been marked as a duplicate of this bug. ***

==Verification==
Versions:
Host:
3.10.0-510.rt56.415.el7.x86_64
qemu-kvm-rhev-2.6.0-26.el7.x86_64

Guest:
3.10.0-510.rt56.415.el7.x86_64

Steps:
1. Boot slirp as background
# /usr/libexec/qemu-kvm \
-net none \
-net socket,vlan=0,udp=localhost:4444,localaddr=localhost:5555 \
-net user,vlan=0

2. Start vubr as server
# ./vhost-user-bridge -l localhost:4444 -r localhost:5555 -u /tmp/vubr.sock

3. Boot guest with 2 NUMA nodes
/usr/libexec/qemu-kvm -m 4096 -smp 4 \
-object memory-backend-file,id=mem0,size=2048M,mem-path=/dev/hugepages,share=on \
-object memory-backend-file,id=mem1,size=2048M,mem-path=/dev/hugepages,share=on \
-numa node,nodeid=0,memdev=mem0 \
-numa node,nodeid=1,memdev=mem1 \
-mem-prealloc \
-vga std -vnc :10 \
/home/pezhang/rhel7.3.qcow2 \
-chardev socket,id=char0,path=/tmp/vubr.sock \
-device virtio-net-pci,netdev=mynet1,mac=54:52:00:1a:2c:01 \
-netdev type=vhost-user,id=mynet1,chardev=char0,vhostforce \
-monitor stdio \
-serial unix:/tmp/monitor,server,nowait \

4. Get ip in guest, and #wget works well
# dhclient

# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.2.15  netmask 255.255.255.0  broadcast 10.0.2.255
        inet6 fe80::5652:ff:fe1a:2c01  prefixlen 64  scopeid 0x20<link>
        inet6 fec0::5652:ff:fe1a:2c01  prefixlen 64  scopeid 0x40<site>
        ether 54:52:00:1a:2c:01  txqueuelen 1000  (Ethernet)
        RX packets 16  bytes 3998 (3.9 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 37  bytes 4904 (4.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

# wget http://download.eng.bos.redhat.com/brewroot/packages/kernel-rt/3.10.0/510.rt56.415.el7/x86_64/kernel-rt-3.10.0-510.rt56.415.el7.x86_64.rpm
...
Saving to: ‘kernel-rt-3.10.0-510.rt56.415.el7.x86_64.rpm’

100%[======================================>] 34,313,752   556KB/s   in 76s    

2016-09-22 15:34:09 (441 KB/s) - ‘kernel-rt-3.10.0-510.rt56.415.el7.x86_64.rpm’ saved [34313752/34313752]


So this bug has been fixed well. Thank you.

Set this bug as 'VERIFIED' as Comment 25.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2673.html