The following patches are queued for QEMU stable v11.0.3:

  https://gitlab.com/qemu-project/qemu/-/commits/staging-11.0

v3: 2 more last-minute fixes from Peter Maydell.  Technically are on
the schedule still.

Patch freeze is 2026-07-22 (frozen), and the release is planned for 2026-07-24:

  https://wiki.qemu.org/Planning/11.0

Please respond here or CC qemu-stable@nongnu.org on any additional patches
you think should (or shouldn't) be included in the release.

The changes which are staging for inclusion, with the original commit hash
from master branch, are given below the bottom line.

Thanks!

/mjt

--------------------------------------
01* eef29e060dcc Emmanuel Blot:
   meson: build macOS signed binary as part of the default target
02* 27f6d5ba9c97 Marc-André Lureau:
   ui/gtk: fix bad widget realize on non-GFX VC
03* a57e4612b61d Christian Borntraeger:
   s390x/kvm: clamp stsi 3.2.2 size
04* a1c0e5a73740 Christian Schoenebeck:
   hw/9pfs: add msize_limit transport callback
05* 4a1a2fa4d351 Christian Schoenebeck:
   9pfs/virtio: implement msize_limit callback
06* 815d1799c3d3 Christian Schoenebeck:
   9pfs/xen: implement msize_limit callback
07* bb5ab96e35a1 Christian Schoenebeck:
   hw/9pfs: cap negotiated msize to transport limit
08* 4b615eaa1be4 Christian Schoenebeck:
   hw/9pfs: add response_buffer_size transport callback
09* 12bcbdca8ae9 Christian Schoenebeck:
   9pfs/virtio: implement response_buffer_size callback
10* 69c8f5e6946f Christian Schoenebeck:
   9pfs/xen: implement response_buffer_size callback
11* 64c6c7e0df72 Christian Schoenebeck:
   hw/9pfs: cap Treaddir allocation (CVE-2026-9238)
12* 693b296b176d Christian Schoenebeck:
   hw/9pfs: add xattr FID limit to prevent memory exhaustion
13* e6116a81f04c Christian Schoenebeck:
   hw/9pfs: add max_xattr option
14* 44cb540d2d07 Christian Schoenebeck:
   qemu-options: document 9pfs max_xattr option
15* 54b8f64c422d Christian Schoenebeck:
   tests/9p: add Tread / Rread test client functions
16* c46150530b3d Christian Schoenebeck:
   tests/9p: add Tclunk / Rclunk test client functions
17* 7664feb26fef Christian Schoenebeck:
   tests/9p: add Txattrcreate / Rxattrcreate test client functions
18* 0e3085ddc7fb Christian Schoenebeck:
   hw/9pfs: enable xattr (mockup) support for synth fs driver
19* 7e42d569a68a Christian Schoenebeck:
   hw/9pfs: add xattr count query interface to fs synth driver
20* df8825554366 Christian Schoenebeck:
   tests/9p: increase P9_MAX_SIZE for test client
21* 84525ece6817 Christian Schoenebeck:
   tests/9p: add virtio_9p_add_synth_driver_args() test client function
22* 0e1085819e44 Christian Schoenebeck:
   tests/9p: add 3 xattr FID limit test cases (synth fs driver)
23* 04a62cdfe873 Christian Schoenebeck:
   tests/9p: add 3 xattr FID limit test cases (local fs driver)
24* 32cae47c332f Christian Schoenebeck:
   hw/9pfs: fix invalid union access by v9fs_co_fsync()
25* c3aa2491cd2c Christian Schoenebeck:
   hw/9pfs: fix invalid union access by v9fs_co_fstat()
26* 75893c058b21 Christian Schoenebeck:
   hw/9pfs/local: harden local_fid_fd() on FID types
27* fa2cf7488379 Inochi Amaoto:
   target/riscv: Check PMP before updating PTE
28* fdfcd98f6656 Qingwei Hu:
   hw/riscv/virt-acpi-build: Fix RINTC PLIC context ID for KVM
29* 46d96da13098 ZhengXiang Qin:
   target/riscv: avoid abort when reading vtype before env->xl is set
30* dcd028517749 SeungJu Cheon:
   target/riscv: Apply UXL WARL handling to vsstatus
31* 64ce9ac18757 Daniel Henrique Barboza:
   hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0
32* 36b37f849480 Laurent Vivier:
   hw/char/virtio-serial-bus: fix guest-triggerable OOM in control_out()
33* 32a90850e1e4 Junjie Cao:
   virtio-net: validate RSS indirections_len in post_load
34* bc22c7e4187a Feifan Qian:
   hw/net/fsl_etsec: validate FCB offsets in process_tx_fcb()
35* d77a93ca4b53 Oliver Upton:
   target/arm: Only evaluate SCR_EL3.PIEN if ARM_FEATURE_EL3 is present
36* 62b425bec3d5 Alex Bennée:
   hw/arm: use cortex-a9 mpcore base for CBAR on npcm7xx machines
37* ec917cd49918 Jesper Wendel Devantier:
   hw/nvme: fix FDP set FDP events
38* 034baf047fe1 Keith Busch:
   hw/nvme: ensure sgl forward progress
39* d88cd8f5570f Christian Borntraeger:
   s390x/sclp: reject invalid write event data headers
40* 2d709a70c757 Matthew Rosato:
   s390x/pci: Tighten region detection for BAR read/write
41* b8c8ec1d7526 Matthew Rosato:
   s390x/pci: Shrink RPCIT ranges to registered window
42* 386268daea86 Matthew Rosato:
   s390x/ioinst: Require strict length and format for SEI CHSC handler
43* 22f2da06a8b2 Eric Farman:
   s390x/css: limit number of CHPIDs in description
44* e819c126a8d9 Miao Wang:
   target/loongarch: Enable TARGET_PAGE_BITS_VARY for loongarch64 user-only
45* 42f599172ae0 Torin Carey:
   hw/misc/edu: restrict dma access to dma buffer
46* 3565faa0ace1 Junjie Cao:
   hw/display/ati: reset host_data.next in write handler after flush
47* 90f8e5c30767 Junjie Cao:
   hw/display/ati: guard against zero bpp in ati_host_data_flush
48* d9f78431d8eb Denis V. Lunev:
   hw/ide/ahci: cancel in-flight buffered reads on command engine restart
49* cb7bc10385f3 Denis V. Lunev:
   tests/qtest/ahci: test ATAPI read completing after engine restart
50* 03071f99a3e1 Peter Maydell:
   hw/dma/i8257: Return zeroes for read_memory in verify mode
51* 831a13665ab1 Peter Maydell:
   hw/scsi/mptsas: Reset doorbell state on reset
52* 0e51b71c7b77 Thomas Huth:
   hw/display/qxl: Fix mono cursor validation that can read past a cursor 
   chunk
53* dbc0ed562230 no92:
   intel_iommu: Correctly set pt bit in extended capability register
54* e03463812e74 lizhaoxin04:
   vdpa: fix use-after-free of vqs in vhost_vdpa_device_unrealize
55* 8addbdb793b7 Nathan Chen:
   hw/arm/smmuv3: Update ATC invalidation check
56* 7913b3b9463f hemanshu.khilari.foss:
   hw/core/qdev-clock: Fix potential null pointer dereference
57* 15c57ac351cc Stefan Hajnoczi:
   scsi: adjust error_prepend() formatting
58* 15a202656cd5 Stefan Hajnoczi:
   scsi: always send valid PREEMPT TYPE field
59* b9a3b329d09d Stefan Hajnoczi:
   scsi: register again after PREEMPT without reservation
60* 9e41b5d22aeb Sanjeeva Yerrapureddy:
   hw/net: fix e1000e/igb ip_len inflation by Ethernet minimum-frame padding
61* b79a9b6e5b56 Richard Henderson:
   accel/tcg: Use TLB_FORCE_SLOW not TLB_MMIO for user-only plugins
62* e03b7dac65d9 Ilya Leoshkevich:
   accel/tcg: Make PageFlagsNodes' start and last immutable
63* c56ebd64b82a Richard Henderson:
   tcg/loongarch64: Fix cmp_vec with TCG_COND_NE
64* 614a52cf549e Randy Schifflin:
   target/sh4: fixup tcg for sh4 fipr/ftrv instructions
65* 4952681a5fdc yujun:
   crypto/x509-utils: fix gnutls error code in crt_init failure path
66* 90aacd5bc405 Jia Jia:
   hw/ufs: avoid double unref of wrapped scsi-hd
67* b18e3f0e2d0f Daniel Henrique Barboza:
   hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults
68* c1d5ec3a2f4b Daniel Henrique Barboza:
   hw/riscv/riscv-iommu.c: check for reserved PTE bits
69* b795ea0ba471 Daniel Henrique Barboza:
   hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access
70* 9158c900ab30 Daniel Henrique Barboza:
   hw/riscv/riscv-iommu.c: fault for non-user PTE in G_STAGE
71* 11486349ad9b Daniel Henrique Barboza:
   hw/riscv/riscv-iommu.c: check reserved MSI PTE basic bits
72* 58e801f74e6a Daniel Henrique Barboza:
   hw/riscv/riscv-iommu-sys.c: record fault on IOMMU-generated MSI write
73* bf274c54295c Daniel Henrique Barboza:
   hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN
74* 79616dd6e499 Daniel Henrique Barboza:
   hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()
75* 6d2b9d542fe2 Daniel Henrique Barboza:
   hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero
76* ca7bac51e04f Chengbo Gao:
   hw/riscv/riscv-iommu: Avoid caching PCI device IDs
77* ce7fb3282756 Daniel Henrique Barboza:
   hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx()
78* c7e61854544b Alistair Francis:
   hw/pci/pcie_doe: Check mailbox length for overflows
79* 18a522099090 Heinrich Schuchardt:
   tests: allow differences in SPCR
80* 15c73b0f17d2 Heinrich Schuchardt:
   hw/acpi: correct field sequence in SPCR table
81* ec7d32428757 Heinrich Schuchardt:
   tests: update SPCR loongarch64 and riscv64 test data
82* a47e3c26b1a0 Peter Maydell:
   linux-user: Validate guest-passed dm_ioctl data_size
83* 79cabc6cb7fb Richard Henderson:
   target/arm: Be more defensive for invalid tlbi_aa64_get_range
84* 4571c79c57ca Peter Maydell:
   hw/net/vmxnet3: Correct bounds check on tx queue index
85* 2c6fae7d7da8 Peter Maydell:
   hw/usb/dev-wacom: Don't write off end of buffer
86* b378a1bd86b4 Peter Maydell:
   hw/display/sm501: Catch bad coordinates for RTL operations
87* 422734d5fc2b Peter Maydell:
   hw/display/sm501: Avoid overflow problems in bounds check calculations
88* 2ac2cf0483d0 Peter Maydell:
   hw/display/sm501: Don't allow guest to set ram size larger than it is
89* 3c2749443429 Peter Maydell:
   hw/misc/stm32_rcc: Correct offset-to-irq calculation
90* 20701190e023 Christian Borntraeger:
   s390x/sclp: prevent re-reading the sclp header
91* 8a116a28535c Christian Borntraeger:
   s390x/sclpcpi: check event length field before reading from buffer
92* 33bece0fa121 Eric Farman:
   s390x/css: firm up handling of chained TIC CCWs
93* 9db18ed0631d Matt Turner:
   linux-user/alpha: add coredump support
94* 7a2e863f9dd5 Matt Turner:
   linux-user/alpha: populate AT_HWCAP from env->amask
95* 5157ceb10ca8 Haotian Jiang:
   hw/misc/ivshmem: clear chardev handlers before freeing peers
96* a3cc0069e151 Marc-André Lureau:
   hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
97* 76dbe26fd650 Dmitry Pimenov:
   hw/sparc64/niagara: use int64_t for vdisk size to avoid truncation
98* 5a811329bde7 Miao Wang:
   hw/scsi/vmw_pvscsi: translate data endianness
99* ecc569639aeb Miao Wang:
   hw/scsi/vmw_pvscsi: add a comment to explain the endianness
100* 564c4d7e99d8 Marc-André Lureau:
   hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
101* 98e5a8eb4fb9 Thomas Huth:
   hw/usb/hcd-ohci: Make sure that ohci_service_ed_list() cannot loop forever
102* 5257259428ea Thomas Huth:
   hw/usb/hcd-xhci: Turn guest-triggerable abort() into qemu_log_mask()
103* 504f2bad932c Rohitashv Kumar:
   net: only advertise passt in netdev help when CONFIG_PASST
104* 3543c2b855cc Marc-André Lureau:
   ui/vnc: fix OOB write in vnc_refresh_lossy_rect
105* fb71c895d7ff Marc-André Lureau:
   ui/vnc: validate color shifts in SetPixelFormat
106* 82b4d693d522 Marc-André Lureau:
   ui/input-barrier: fix off-by-one in keycode bounds check
107* 53f0d87db7b4 Akihiko Odaki:
   ui/gtk: Narrow DMA-BUF critical section
108* e650e4fe0fb3 Marc-André Lureau:
   ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
109* 6075444c5a72 Marc-André Lureau:
   ui/vnc: validate SetPixelFormat field ranges
110* 8720061c6d34 Marc-André Lureau:
   hw/display/virtio-gpu: cap submit_3d command buffer allocation
111* e99488c5d4a0 Marc-André Lureau:
   hw/display/virtio-gpu: handle migration iov allocation failure
112* f1af81ba2aee Akihiko Odaki:
   hw/display/virtio-gpu: Check pixman_image_create_bits() results
113* 78420b59f0fe Alex Bennée:
   accel/tcg: move jit thread manipulation into do_tb_phys_invalidate
114* 12d8ee9d5358 Feifan Qian:
   hw/usb/xhci: clamp interval exponent to avoid UB shift in 
   xhci_init_epctx()
115* 054ef33f674c Xiangfeng Cai:
   hw/usb/hcd-xhci-pci: break host link cycle so device_finalize() runs on 
   unplug
116* ba54d7e66e25 Xiangfeng Cai:
   tests/qtest: add xhci-pci unplug finalize regression test
117* 9bf52d056a03 Marc-André Lureau:
   usbredir: fix use-after-free on buffered bulk packet overflow
118* a002485bfef1 Marc-André Lureau:
   usbredir: fix infinite loop and SIGFPE with zero max_packet_size
119* 4daeaa2fe0f9 Thomas Huth:
   hw/usb/hcd-xhci: Fix guest-triggerable assert() in xhci_find_stream()
120* cc479aa89743 Thomas Huth:
   hw/usb/hcd-xhci-sysbus: Fix OOB heap access in xhci_sysbus_intr_raise()
121* 83927347227c Jay Chang:
   hw/net/xilinx_axienet: Fix PHY register 17 link status reporting
122* b1e73b2ddbb2 Peter Maydell:
   net: Correct padding check in qemu_receive_packet()
123* 9f436938c521 Marc-André Lureau:
   hw/display/qxl: validate monitors_config heads[] in phys2virt
124* fe68e4b47bf5 Marc-André Lureau:
   replay: fix use of uninitialized pointer on error
125* 2142689d92ca Philippe Mathieu-Daudé:
   hw/misc/applesmc: Fix a typo setting MSSD key
126* 94c510a5dc48 Bin Meng:
   hw/net/cadence: Return current Cadence GEM queue pointers
127* c257745248b0 Haotian Jiang:
   hw/audio/intel-hda: restrict all DMA engine paths to memories
128 6fd2fcdc61b7 Alex Bennée:
   target/arm: teach arm_cpu_has_work about halting reasons
129 c2804566f654 Alex Bennée:
   target/arm: do not clear halting reason in has_work helper

(commit(s) marked with * were in previous series and are not resent)