I bisected it to

commit 6e6fcbc27e7788af54139c53537395d95560f2ef (HEAD, tag: this-breaks-simmerv)
Author: Ming Lei <ming.lei@redhat.com>
Date:   Tue Jun 30 18:25:01 2020 +0800

    blk-mq: support batching dispatch in case of io

being the first commit that causes a hang (FWIW, this is between v5.8 and v5.9, so fairly old kernels). Nothing in that commit stands out, but it's natural to suspect the virtio block device implementation (which does seem full of TODOs). However, I visually compared with the more mature implementation from TinyEmu and found nothing obvious.

Possible steps forward:

• see if this kernel also hangs when used only with an initrd (instead of the virtio blk dev)
• trace the MMIO and interrupt traffic in and out of virtio and look for clues in the difference between the traces from the working boot and the failing one
• port over the entire implementation from Dromajo (originally TinyEmu)

Of course if the issue still happens with initrd, then virtio can immediately be ruled out.