read-modify-write page faults error code has write bit unset

Consider the attached C file, which does a read-modify-write of the form `add [mem], reg`, where `mem` points to a non-present page. In the resulting page fault, the W/R bit is not set, while real hardware does set this bit.

% gcc -m32 qemu-bug1.c&& ./a.out && qemu-i386 ./a.out
page fault: addr=0x70000000 err=0x6
page fault: addr=0x70000000 err=0x4

Tested on the qemu-3.0.0-rc1 release.