The async nature of the hot-unplug enables an easy to reproduce race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged (or the ACPI unplug has been acked by the guest?). The guest can use this time window to, at least, trigger an assertion.
Created qemu tracking bugs for this issue: Affects: fedora-all [bug 2228125]
Upstream fix: https://github.com/qemu/qemu/commit/a0d7215e339b61c7d7a7b3fcf754954d80d93eb8
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:6980 https://access.redhat.com/errata/RHSA-2023:6980