Additional info:

This bug could be reproduced 100% when kill the qemu-kvm process e.g.
#kill -9 $pid of qemu-kvm

Close this bug according to comment #2.

Sorry, I made a mistake. Please ignore comment #3

(In reply to comment #2)
> Additional info:
> 
> This bug could be reproduced 100% when kill the qemu-kvm process e.g.
> #kill -9 $pid of qemu-kvm

downscript could not be executed if you use 'SIGKILL' to kill qemu process.
downscript can be executed to cleanup tap if you kill by default signal of kill

# kill $qemu-pid

However, the problem in comment #1 is a real bug.

====

tap device would be created when net_init_clients() is called.
'device' option is parsed after calling net_init_clients().
we should call net_cleanup() when device parse fails.


I did a quick fix, the tap device should be removed in the situation of comment #1.
But there are many "exit(1)" after calling net_init_clients() in vl.c, it's ugly to call net_cleanup() before each exit.
Not sure if we have some exit(1) in other sub functions, which is also called after calling net_init_clients().

@@ -3882,8 +3889,11 @@ int main(int argc, char **argv, char **envp)
     }

     /* init generic devices */
-    if (qemu_opts_foreach(qemu_find_opts("device"), device_init_func, NULL, 1) != 0)
+    if (qemu_opts_foreach(qemu_find_opts("device"), device_init_func,
+                          NULL, 1) != 0) {
+        net_cleanup();
         exit(1);
+    }

Posted patch to upstream:
http://lists.nongnu.org/archive/html/qemu-devel/2012-12/msg01348.html

1.Reproduced this bug with qemu-kvm-0.12.1.2-2.335.el6.x86_64
steps:
1.run guest like this 
<qemu-kvm cmdline>...-netdev tap,id=hostnet0,vhost=on,script=/etc/ovs-ifup,downscript=/etc/ovs-ifdown -device virtio-pci-net,netdev=hostnet0,id=virt-net0,mac=54:52:1a:32:b4:01 ...

which virtio-pci-net is  a wrong discription

Then qemu-kvm quit w/ following messages:
qemu-kvm: -device virtio-pci-net,netdev=hostnet0,id=virt-net0,mac=54:52:1a:32:b4:01: Parameter 'driver' expects a driver name
Try with argument '?' for a list.

Result:tap0 is still in the ovs bridge, So, base on above testing, this bug is reproduced

# ovs-vsctl show
83f619a3-afd0-47ce-8ac7-c716daa4f662
    Bridge "ovs0"
        Port "eth0"
            Interface "eth0"
        Port "ovs0"
            Interface "ovs0"
                type: internal
        Port "tap0"
            Interface "tap0"
    ovs_version: "1.9.0"


Verify this bug w/ qemu-kvm-0.12.1.2-2.377.el6.x86_64:
Steps:
1.run guest like this 
<qemu-kvm cmdline>...-netdev tap,id=hostnet0,vhost=on,script=/etc/ovs-ifup,downscript=/etc/ovs-ifdown -device virtio-pci-net,netdev=hostnet0,id=virt-net0,mac=54:52:1a:32:b4:01 ...

which virtio-pci-net is  a wrong discription

Then qemu-kvm quit w/ following messages:
qemu-kvm: -device virtio-pci-net,netdev=hostnet0,id=virt-net0,mac=54:52:1a:32:b4:01: Parameter 'driver' expects a driver name
Try with argument '?' for a list.

Result:There's no tap device in the ovs bridge, so base on above testing, this bug is verified by qemu-kvm-0.12.1.2-2.377.el6.x86_64 .
# ovs-vsctl show
83f619a3-afd0-47ce-8ac7-c716daa4f662
    Bridge "ovs0"
        Port "eth0"
            Interface "eth0"
        Port "ovs0"
            Interface "ovs0"
                type: internal
    ovs_version: "1.9.0"

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-1553.html