Bugs in qemu? accessing null descriptor not trigger #GP

[bluemoon]

I tried the following code in 32-bit protected mode:

Code: Select all

    xor     eax, eax
    mov     ds, ax
    mov     dword [ds:0xb8000 + 324], 0x07460746
    cli
    hlt

0xb8000 is identity mapped for debugging. The FF is shown on screen, and #GP is not triggered, is it a bug with QEmu or did I missed anything?

This is the version I'm using:

Code: Select all

qemu-system-i386 bluemoon.img --version
QEMU emulator version 1.0, Copyright (c) 2003-2008 Fabrice Bellard

[deadbeef]

This absolutely GP-faults on real HW.

For Qemu on my machine:
In QEMU 1.0.50 (build from most recent sources) it also GP-Faults.
In QEMU 0.12.5 via KVM (from Ubuntu repos on install of kvm) it GP-faults.
In QEMU 0.12.5 (from Ubuntu repos on install of kvm) with -no-kvm it does not GP-fault (but I can't tell right now if the emulation is still in a correct state).