Dear Maintainer,

Windows 11 25H2 (build 26200.9457) guest under libvirt/QEMU boots on 7.1.13
but fails into Automatic Repair on 7.2.9 and 7.2.10. Userspace is identical:
libvirt 12.8.0-1, qemu 11.1.2+ds-1 (also -2), OVMF 4M .ms.fd, swtpm tpm-crb.

Guest: VBS running, Credential Guard on, HVCI not running, App Control
policy enforced (Win32_DeviceGuard output attached).
VM: q35-9.2, host-passthrough, hv_relaxed/vapic/spinlocks/vpindex/synic/
stimer/reset/frequencies/tlbflush/ipi, hypervclock. XML attached.
CPU: 11th Gen Intel(R) Core(TM) i7-11850H, microcode 0x58.

Evidence it is MBEC in nested VMX:
- domcapabilities (host-passthrough) differs between kernels only by new
  vmx-mbec and vmx-ept-advanced-exitinfo; CPU flags identical.
- kvm_intel has a new parameter mbec=Y on 7.2.
- modprobe -r kvm_intel; modprobe kvm_intel mbec=0 -> VM boots.


This could break existing deployments of Windows VMs, as the Automatic Repair
does not actually repair anything successfully, and the guest OS never boots.

While this might be solved by editing the <cpu> of the guest and passing
features such as <feature policy='disable' name='vmx-mbec'/>, unless this is
documented, the kernel update might cause interruptions in existing
environments
(e.g. where those guests are set to auto-start with the Debian system)

Kernel is tainted by out-of-tree nvidia (patched DKMS 550) and evdi