Klaus, This isn't going to help your issue, but there are at least two legacy irq bugs in the nvme qemu implementation.
1. The admin queue breaks if start with legacy and later initialize msix. 2. The legacy vector is shared among all queues, but it's being deasserted when the first queue's doorbell makes it empty. It should remain enabled if any cq is non-empty. I'll send you some patches for those later. Still working on the real problem.