Test PASS with qemu-kvm-8.0.0-1.el9.x86_64.
Test Env:
  Host:
    qemu-kvm-8.0.0-1.el9.x86_64
    5.14.0-300.el9.x86_64
  Guest: 5.14.0-300.el9.x86_64


Test results inside guest:
# ./a.out 
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15


@yoguo Would you please help to test the libguestfs regression test for this bug? Thanks.

Addtional info:

guest# virt-what 
redhat
qemu

Tested with the following packages on RHEL9.3 host:

qemu-kvm-8.0.0-1.el9.x86_64
libguestfs-1.50.1-3.el9.x86_64
kernel-5.14.0-300.el9.x86_64


Steps:

1.
$ LIBGUESTFS_BACKEND=direct LIBGUESTFS_BACKEND_SETTINGS=force_tcg libguestfs-test-tool
...
/usr/libexec/qemu-kvm \
    -global virtio-blk-pci.scsi=off \
    -no-user-config \
    -nodefaults \
    -display none \
    -machine q35,accel=tcg,graphics=off \
    -cpu max,la57=off \
    -m 1280 \
    -no-reboot \
    -rtc driftfix=slew \
    -no-hpet \
    -global kvm-pit.lost_tick_policy=discard \
    -kernel /var/tmp/.guestfs-1002/appliance.d/kernel \
    -initrd /var/tmp/.guestfs-1002/appliance.d/initrd \
    -object rng-random,filename=/dev/urandom,id=rng0 \
    -device virtio-rng-pci,rng=rng0 \
    -device virtio-scsi-pci,id=scsi \
    -drive file=/tmp/libguestfsU9fh1Z/scratch1.img,cache=unsafe,format=raw,id=hd0,if=none \
    -device scsi-hd,drive=hd0 \
    -drive file=/var/tmp/.guestfs-1002/appliance.d/root,snapshot=on,id=appliance,cache=unsafe,if=none \
    -device scsi-hd,drive=appliance \
    -device virtio-serial-pci \
    -serial stdio \
    -chardev socket,path=/run/user/0/libguestfsFfbIfi/guestfsd.sock,id=channel0 \
    -device virtserialport,chardev=channel0,name=org.libguestfs.channel.0 \
    -append "panic=1 console=ttyS0 edd=off udevtimeout=6000 udev.event-timeout=6000 no_timer_check printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=UUID=94874061-5b04-4ef4-aeef-606990aeef3a selinux=0 guestfs_verbose=1 TERM=xterm-256color"
qemu-kvm: -no-hpet: warning: -no-hpet is deprecated, use '-machine hpet=off' instead
\x1bc\x1b[?7l\x1b[2J\x1b[0mSeaBIOS (version 1.16.1-1.el9)
Booting from ROM..\x1bc\x1b[?7l\x1b[2J[    0.000000] Linux version 5.14.0-300.el9.x86_64 (mockbuild.eng.bos.redhat.com) (gcc (GCC) 11.3.1 20221121 (Red Hat 11.3.1-4), GNU ld version 2.35.2-39.el9) #1 SMP PREEMPT_DYNAMIC Mon Apr 17 04:33:53 EDT 2023
[    0.000000] The list of certified hardware and cloud instances for Red Hat Enterprise Linux 9 can be viewed at the Red Hat Ecosystem Catalog, https://catalog.redhat.com.
[    0.000000] Command line: panic=1 console=ttyS0 edd=off udevtimeout=6000 udev.event-timeout=6000 no_timer_check printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=UUID=94874061-5b04-4ef4-aeef-606990aeef3a selinux=0 guestfs_verbose=1 TERM=xterm-256color
...
===== TEST FINISHED OK =====

Sanity check passed on libguestfs side.

QE bot(pre verify): Set 'Verified:Tested,SanityOnly' as gating/tier1 test pass.

Move to verified according to Comment 3 and Comment 5.