device: 0.769 user-level: 0.720 semantic: 0.692 socket: 0.564 arm: 0.549 assembly: 0.548 graphic: 0.532 mistranslation: 0.528 debug: 0.499 ppc: 0.488 vnc: 0.455 boot: 0.450 register: 0.426 network: 0.424 i386: 0.411 PID: 0.399 risc-v: 0.370 kernel: 0.363 architecture: 0.354 x86: 0.315 files: 0.304 TCG: 0.302 virtual: 0.293 VMM: 0.220 performance: 0.152 KVM: 0.132 permissions: 0.117 peripherals: 0.095 hypervisor: 0.092 QEMU in user-mode emulation mode crashes when the user program jumps to an invalid address Running this code: void (*func)() = 0x12345678; int main() { func(); return 0; } Produces the following output: qemu-arm-static: /build/qemu-DqynNa/qemu-2.8+dfsg/translate-all.c:175: tb_lock: Assertion `!have_tb_lock' failed. qemu-arm-static: /build/qemu-DqynNa/qemu-2.8+dfsg/translate-all.c:175: tb_lock: Assertion `!have_tb_lock' failed. Segmentation fault The expected result is as follows: qemu: uncaught target signal 11 (Segmentation fault) - core dumped Segmentation fault I'm not sure exactly when we fixed this (the fix is probably in the 4.1 release) but as of current head-of-git this correctly generates the SIGSEGV.