I was adding error detection to my OS's IDE driver, and noticed that when I read a non-existent sector, say 0xDEADBEEF on a 20MB hard disk image, ERR does not get set in the IDE status register. VMWare and Bochs correctly set this, so I'm pretty sure it's QEMU and not my bad coding. I'm using Linux as host and Popcorn (popcorn-os.sourceforge.net in case you need the code that causes this) as guest.