Comment 15 for bug 595438

valgrind --malloc-fill=0x69 --free-fill=0x11

Process terminating with default action of signal 11 (SIGSEGV)
==00:00:01:03.046 29447== Access not within mapped region at address 0x11111151
==00:00:01:03.046 29447== at 0x80B4713: scsi_req_free (scsi-bus.c:153)
==00:00:01:03.047 29447== by 0x80B186B: scsi_remove_request (scsi-disk.c:86)
==00:00:01:03.047 29447== by 0x8095280: qcow_aio_write_cb (qcow2.c:640)
==00:00:01:03.047 29447== by 0x80849BE: posix_aio_process_queue (posix-aio-compat.c:460)
==00:00:01:03.047 29447== by 0x8084A76: posix_aio_read (posix-aio-compat.c:501)
==00:00:01:03.047 29447== by 0x805E3D7: main_loop_wait (vl.c:1300)
==00:00:01:03.047 29447== by 0x806EA83: kvm_main_loop (qemu-kvm.c:1710)
==00:00:01:03.047 29447== by 0x8060A72: main (vl.c:1340)

It seems, that 0x11111151 - is a pointer inside already freed region :(

http://dl3.ideco-software.ru/IdecoICS/IdecoICS_342_123.iso
http://dl1.ideco-software.ru/IdecoICS/IdecoICS_342_123.iso
http://dl2.ideco-software.ru/IdecoICS/IdecoICS_342_123.iso

(If you get 404, please inform me, I will give new links.)

Instructions how to reproduce:
after boot: type "setup100hz action=install p=1" and press Enter. Line should look as:

boot: setup100hz action=install p=1

In each experiment
You need fresh (empty) "qemu-img create -f qcow2 8G" image (preferable in tmpfs filesystem) Image will be expanded nearly to 1.5 Gb. I have VMX-enabled Intel processor and 32-bit kernel. KVM was built just using ./configure && make

command:
qemu-system-x86_64 -drive file=xxx.img,cache=writeback,if=scsi -cdrom IdecoICS_342_123.iso

It will show some dialogs while copying files after which it will go to reboot if all OK.
In our case: somewhere during copying files, kvm will do segmentation fault, before rebooting of VM.