What were you trying to do that didn't work?

When starting a domain on a host which lacks a vmx-* CPU feature which is
expected to be enabled by the CPU model specified in the domain XML, libvirt
marks such feature as disabled in the active domain XML. But migrating the
domain to a similar host which lacks the same vmx-* feature will fail with
libvirt reporting the feature is missing. This is because of a bug in the
hack ensuring backward compatibility, libvirt running on the destination
thinks the missing feature is expected to be enabled.

Please provide the package NVR for which bug is seen:

libvirt-10.0.0-6.4.el9_4

How reproducible:

100%

Steps to reproduce

It may be hard to find hosts which would trigger such bug, but the situation
can easily be simulated in a virtual environment.

1. Start two domains with a CPU definition similar to the following:

   <cpu mode='host-model' check='none'>
     <feature policy='require' name='vmx'/>
     <feature policy='disable' name='vmx-apicv-register'/>
   </cpu>
   

   The disabled feature should be listed with added='yes' in
   src/cpu_map/x86_*.xml file corresponding to the CPU model to which
   host-model expands to (see virsh domcapabilities to check what model
   it would be).

1. In one of the VMs from step 1 start a nested domain using host-model
   CPU.
2. Once the nested domain is running the vmx-* feature disabled in step 1
   should also be marked as disabled in the output of virsh dumpxml NESTED
3. Migrate the nested domain to the other VM created in step 1

Expected results

Migration succeeds

Actual results

error: operation failed: guest CPU doesn't match specification: missing features: vmx-apicv-register