Here's the upstream commit that would need to be backported to fix the bug.

commit c5815b31976f3982d18c7f6c1367ab6e403eb7eb
Author: Jonathon Jongsma <jjongsma>
Date:   Tue Jun 23 13:29:56 2020 -0500

    qemu: format 'ramfb' attribute for mediated devices
    
    It's possible to use ramfb as the boot display of an assigned vgpu
    device. This was introduced in 4b95738c, but unfortunately the attribute
    was not formatted into the xml output for such a device. This patch
    fixes that oversight and adds a xml2xml test to verify proper behavior.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1847791
    
    Signed-off-by: Jonathon Jongsma <jjongsma>
    Reviewed-by: Daniel Henrique Barboza <danielhb413>
    Signed-off-by: Ján Tomko <jtomko>
    Reviewed-by: Ján Tomko <jtomko>

Verified with libvirt-daemon-6.0.0-32.module+el8.4.0+9172+b707c649.x86_64.

Test steps:
1.Edit guest xml to set mdev device with "ramfb='on'":
#virsh edit vm1
...
 <hostdev mode='subsystem' type='mdev' managed='no' model='vfio-pci' display='on' ramfb='on'>
      <source>
        <address uuid='49bf2346-6747-4ad6-be5a-adc2f0a10b5c'/>  
    </source>
    <alias name='ua-0febf033-9953-40e1-b803-2df42b0bac4e'/>
</hostdev>
...

2.Check the guest xml, there is 'ramfb' setting in the mdev device:
# virsh dumpxml vm1 | grep -A7 mdev
    <hostdev mode='subsystem' type='mdev' managed='no' model='vfio-pci' display='on' ramfb='on'>
      <source>
        <address uuid='49bf2346-6747-4ad6-be5a-adc2f0a10b5c'/>
      </source>
      <alias name='ua-0febf033-9953-40e1-b803-2df42b0bac4e'/>
      <address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
    </hostdev>

3.Start the guest again:
# virsh start vm1
Domain vm1 started

4.Check the guest xml, 'ramfb' setting still in the mdev device:
# virsh dumpxml vm1 | grep -A7 mdev
  <hostdev mode='subsystem' type='mdev' managed='no' model='vfio-pci' display='on' ramfb='on'>
      <source>
        <address uuid='49bf2346-6747-4ad6-be5a-adc2f0a10b5c'/>
      </source>
      <alias name='ua-0febf033-9953-40e1-b803-2df42b0bac4e'/>
      <address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
    </hostdev>

5.Check the qemu cmd line, can see the 'ramfb' setting:
#ps aux | grep -i ramfb
...-device vfio-pci-nohotplug,id=ua-0febf033-9953-40e1-b803-2df42b0bac4e,sysfsdev=/sys/bus/mdev/devices/49bf2346-6747-4ad6-be5a-adc2f0a10b5c,display=on,bus=pci.7,addr=0x0,ramfb=on...

6.Destroy the guest:
#virsh destroy vm1

7.Start the guest:
#virsh start vm1

8.Check the qemu cmd line:
#ps aux | grep -i ramfb
...-device vfio-pci-nohotplug,id=ua-0febf033-9953-40e1-b803-2df42b0bac4e,sysfsdev=/sys/bus/mdev/devices/49bf2346-6747-4ad6-be5a-adc2f0a10b5c,display=on,bus=pci.7,addr=0x0,ramfb=on...

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:1762