FYI, we solved a similar sounding issue by clearing the PKRU bit if it was set in the to-be-restored XSAVE blob, but not available in the current vCPU feature flags:
https://git.proxmox.com/?p=pve-kernel.git;a=blob;f=patches/kernel/0008-kvm-xsave-set-mask-out-PKRU-bit-in-xfeatures-if-vCPU.patch;h=dda75b87de9a18ecb3a51d01d487727db77825e7;hb=1559d22f3510d8532aa756fe5d69c74c76211e1e
FYI, we solved a similar sounding issue by clearing the PKRU bit if it was set in the to-be-restored XSAVE blob, but not available in the current vCPU feature flags:
https:/ /git.proxmox. com/?p= pve-kernel. git;a=blob; f=patches/ kernel/ 0008-kvm- xsave-set- mask-out- PKRU-bit- in-xfeatures- if-vCPU. patch;h= dda75b87de9a18e cb3a51d01d48772 7db77825e7; hb=1559d22f3510 d8532aa756fe5d6 9c74c76211e1e