The symptom I've observed is that qemu reports the first instruction of
the basic block rather than the exchange itself. If you "x/10i <fault
eip>", you should see an xchg before long.
Either way, sounds like a qemu bug which should be reported to them.