Looks like a double free:

#8  0x00007f261ab425ed in g_free (mem=0x7f26080432d0) at ../glib/gmem.c:199
#9  0x00007f261a6bdd66 in virBitmapFree (bitmap=0x7f260802ff70) at ../src/util/virbitmap.c:97
#10 virBitmapFree (bitmap=0x7f260802ff70) at ../src/util/virbitmap.c:94
#11 0x00007f261a75d153 in virDomainNetDefFree (def=0x7f2604028860) at ../src/conf/domain_conf.c:2749
#12 virDomainNetDefFree (def=def@entry=0x7f2604028860) at ../src/conf/domain_conf.c:2704
#13 0x00007f26140fe3f4 in qemuDomainRemoveHostDevice (driver=0x7f25cc022310, vm=0x7f25cc08e850, hostdev=<optimized out>) at ../src/qemu/qemu_hotplug.c:4564

The free call seems to correspond with:

virBitmapFree(def->source.subsys.u.pci.origstates);

Created attachment 1954672 [details]
bisection

Bisection shows the regression comes from:
d9e4075d4e9e4d699b5083572a534545f35a91b1 is the first bad commit
commit d9e4075d4e9e4d699b5083572a534545f35a91b1
Author: Peter Krempa <pkrempa>
Date:   Thu Oct 6 13:17:00 2022 +0200

    conf: Store 'origstates' of PCI hostdevs in a bitmap
    
    Refactor the code to use a bitmap with an enum.
    
    Signed-off-by: Peter Krempa <pkrempa>
    Reviewed-by: Ján Tomko <jtomko>
    Reviewed-by: Martin Kletzander <mkletzan>

 src/conf/domain_conf.c      | 97 ++++++++++++++++++++++-----------------------
 src/conf/domain_conf.h      | 31 +++++----------
 src/conf/virconftypes.h     |  2 -
 src/hypervisor/virhostdev.c | 25 +++++++-----
 4 files changed, 72 insertions(+), 83 deletions(-)


Run the following:
0. Clone libvirt git tree to ~. Extract the attachment to ~. Prepare the disk image as the domain XML rhel.xml; Update your vf PCI address to the inf.xml.
1. Run the virtqemud-onece.sh to trigger the crash. Then the buggy virtqemud version cannot start while the previous qemu-kvm process is running.
2. Run the virtqemud-abrt.sh as the script for bisection.

Fixed by:

commit 0bfd11dd852335c1274b6dc1e771bd745d1fd94d 
Author: Peter Krempa <pkrempa>
Date:   Thu Mar 30 11:42:31 2023 +0200

    conf: Clear pointer to freed bitmap holding hostdev's 'origstates'
    
    'virDomainHostdevDefClear' must clear the pointers too as it can be
    invoked multiple times on the same object e.g. inside
    qemuDomainRemoveHostDevice once via virDomainHostdevDefFree which skips
    freeing the object if it's used via <interface> and thus has a 'net'
    definition corresponding to it, and then subsequently via
    virDomainNetDefFree.
    
    Fix it by clearing the pointer along with freeing it.
    
    Fixes: d9e4075d4e9
    Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2182961
    Signed-off-by: Peter Krempa <pkrempa>
    Reviewed-by: Ján Tomko <jtomko>

v9.2.0-rc2-1-g0bfd11dd85

For the test of comment4, PASS on v9.2.0-rc2-1-g0bfd11dd85
+ timeout -s INT 3 /root/libvirt/build/src/virtqemud
2023-03-31 01:47:14.987+0000: 84639: info : libvirt version: 9.2.0
2023-03-31 01:47:14.987+0000: 84639: info : hostname: dell-per740xd-19.lab.eng.pek2.redhat.com
2023-03-31 01:47:14.987+0000: 84639: error : virCgroupDenyDevicePath:2256 : Path '/dev/vfio/137' is not accessible: No such file or directory
2023-03-31 01:47:14.987+0000: 84639: warning : qemuDomainRemoveHostDevice:4525 : Failed to remove host device cgroup ACL
+ '[' 124 -eq 134 ']'
+ exit 0

No such issue exists in automation function test job with libvirt-9.2.0-1.el9.x86_64.

Test on libvirt-9.3.0-2.el9.x86_64, the issue is fixed.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: libvirt security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:6409