I'm suspecting that there's a bug in Qemu's emulation of the x86
'bound' instruction. The effect of this bug seems to be to add 1 to
the ESP register, which of course havocs everything.
I'm not confident I understand the information in /tmp/qemu.log, but
as I said I suspect that the following in_asm is the culprit:
0x0015d716: bound %esp,%fs:0xffffffe7(%edi)
This instruction, in 32-bit protected mode, is intended to verify that
ESP is within some bounds. These bounds are located at the physical
address 0x100054, which is the result of the instruction's address
because EDI=0x6d and the FS selector points to a segment that starts
at 0x100000.
I have verified that the exact same thing happens when the FS-override
instruction prefix is removed from the bounds instruction above, so
that the DS segment, which happens to be identical to the FS segment,
is used.
The following is a piece of /tmp/qemu.log that I hope provides the
relevant context. As you can see, the value of ESP appears to change
to an odd value for no good reason.