Segfault in audio_pcm_sw_write with audio over VNC

QEMU 5.0.0, built with ./configure --target-list=x86_64-softmmu --enable-debug --disable-strip --disable-docs --disable-sdl

Running on a headless host (Ryzen 3600), Arch Linux, 64bit latest.
Guest is also Arch Linux, 64bit.

Started with qemu-system-x86_64 -vnc 0.0.0.0:0 -enable-kvm -m 4096 -cpu host -smp cores=2,threads=1,sockets=1 -machine q35 -vga std -device
 ich9-ahci,id=ahci -drive file=vm0.qcow2,format=qcow2,if=none,id=dsk0 -device ide-hd,drive=dsk0,bus=ahci.0 -soundhw hda

So, a headless VM is running on a server and is being connected to over VNC. The virtual sound card is detected and speaker test is running inside the VM. So far so good.

Then, i tell the VNC client to enable audio (QEMU Audio Client Message, 255,1,0). QEMU responds with a "stream is about to start" message (QEMU Audio Server Message, 255,1,1) and then promptly crashes without sending anything else.

Running it in GDB produces a crash at audio/audio.c:739

Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
audio_pcm_sw_write (sw=0x5555575bbf30, buf=0x0, size=1628) at audio/audio.c:739
739             if (!sw->hw->pcm_ops->volume_out) {

The exact sequence of events does not matter - i can enable sound before playing anything, and then it would say nothing and keep working, but crash with the same message once anything sound-playing is launched in the VM.

Using different soundhw or adding various audiodev options does not seem to affect anything.

I can't quite figure out if the QEMU Audio VNC extension is supposed to work at all or not, but it would be handy to me if it is.