Description of problem:

When I want to network boot the KVM guest via PXE, qemu-kvm abort()s and leaves
a core dump.

Version-Release number of selected component (if applicable):

kvm-35-2.fc7
kernel-2.6.22.9-91.fc7
(I have "Intel(R) Core(TM)2 CPU" processor, so I use kvm_intel module)

Steps to Reproduce:
Any scenario that loads any of pxe* roms, say
$ qemu-kvm /dev/zero -boot n
or
$ qemu-kvm /dev/zero -option-rom /usr/share/kvm/pxe-ne2k_pci.bin 
or
$ qemu-kvm /dev/zero -option-rom /usr/share/kvm/pxe-lance.bin 
  
Actual results:

$ qemu-kvm /dev/zero -boot n
Could not configure '/dev/rtc' to have a 1024 Hz timer. This is not a fatal
error, but for better emulation accuracy either use a 2.6 host Linux kernel or
type 'echo 1024 > /proc/sys/dev/rtc/max-user-freq' as root.
Warning: No DNS servers found
exception 13 (0)
rax 000000000000f001 rbx 000000000000d713 rcx 0000000000000001 rdx 0000000000000000
rsi 00000000ffff0096 rdi 000000000008f7f4 rsp 000000000000ffb8 rbp 000000000000ffcc
r8  0000000000000000 r9  0000000000000000 r10 0000000000000000 r11 0000000000000000
r12 0000000000000000 r13 0000000000000000 r14 0000000000000000 r15 0000000000000000
rip 0000000000000a45 rflags 00033002
cs f000 (000f0000/0000ffff p 1 dpl 3 db 0 s 1 type 3 l 0 g 0 avl 0)
ds 0000 (00000000/0000ffff p 1 dpl 3 db 0 s 1 type 3 l 0 g 0 avl 0)
es 07c0 (00007c00/0000ffff p 1 dpl 3 db 0 s 1 type 3 l 0 g 0 avl 0)
ss 0000 (00000000/0000ffff p 1 dpl 3 db 0 s 1 type 3 l 0 g 0 avl 0)
fs 0000 (00000000/0000ffff p 1 dpl 3 db 0 s 1 type 3 l 0 g 0 avl 0)
gs 0000 (00000000/0000ffff p 1 dpl 3 db 0 s 1 type 3 l 0 g 0 avl 0)
tr 0000 (08858000/00002088 p 1 dpl 0 db 0 s 0 type b l 0 g 0 avl 0)
ldt 0000 (00000000/0000ffff p 1 dpl 0 db 0 s 0 type 2 l 0 g 0 avl 0)
gdt fa580/30
idt 0/3ff
cr0 60000010 cr2 0 cr3 0 cr4 0 cr8 0 efer 0
code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 --> 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Aborted (core dumped)
$ 

Expected results:

Network-boot the guest.

Additional info:

If the dump above is not enough to spot the problem (i.e. the guilty instruction
or whatever, I just don't understand this sort of things), I'd be glad to either
provide the core dump or try to suck some information from it.

Also, qemu (without KVM) works perfectly.