virtio-balloon-device locks up Guest

Setting arbitrary balloon target values locks up the guest in some cases crashes it, if the target memory is < used +~5% free.  
Found while testing aggressive memory over-commit, scenarios.
You get messages like:

[  155.827448] [<c002060c>] (show_stack) from [<c041c518>] (dump_stack+0x6c/0x88)
[  155.837076] [<c041c518>] (dump_stack) from [<c0091994>] (warn_alloc_failed+0xe0/0x120)
[  155.847075] [<c0091994>] (warn_alloc_failed) from [<c0094480>] (__alloc_pages_nodemask+0x600/0x91c)
[  155.859039] [<c0094480>] (__alloc_pages_nodemask) from [<c00da414>] (balloon_page_enqueue+0x20/0xbc)
[  155.870556] [<c00da414>] (balloon_page_enqueue) from [<c025d794>] (balloon+0x140/0x2cc)
[  155.881377] [<c025d794>] (balloon) from [<c0043b38>] (kthread+0xd8/0xf4)

page dumped bacause: nonzero _count
BUG: BAad page state in process Xorg pfn:396e5

Test Environment:
x86_64
Ubuntu 13.10, Guest Linux Kernel 3.19, qemu 2.2.0 with following patches applied - balloon OOM enhancement
commit 5a10b7dbf904bfe01bb9fcc6298f7df09eed77d5
Author: Raushaniya Maksudova <email address hidden>

Boot guest with '-balloon virtio', -qmp .... -hmp access
1. sudo info balloon | socat - tcp4-connect:127.0.0.1:4444
   - or over qmp interface
{"execute":"qom-get", "arguments": { "path": "/machine/peripheral-anon/device[1]","property": "guest-stats" }}
{"return": {"stats": {"stat-swap-out": 0, "stat-free-memory": 513454080, "stat-minor-faults": 1261, "stat-major-faults": 0, "stat-total-memory": 526073856, "stat-swap-in": 0}, "last-update": 11109}}

2. Take memory down check free memory using (1)
3. Issue "sudo echo balloon XXX | socat - tcp4-connect:127.0.0.1:4444" - XXX is value in threshold mentioned above
   and you get Guest lockup

ARM - samething except '-device virtio-balloon-device' used

Libvirt - virsh setmem causes same issue.