Comment 23 for bug 1208455

I saw a similar crash when running the prepare script with a Saucy64 host, a Saucy32 1rst and Saucy32 2nd level guest. The 1rst level guest cpu set to core2duo and I also had to replace the qemu-system-x86_64 by qemu (which maps to the same arch). Otherwise the 2nd level guest was not started at all.

That would on one run give a double-fault as you had, but the second attempt did succeed. Though both runs had a lot of NMI (reason 21 and 31) messages in them.