I can confirm this to be an issue with 2.5+dfsg-4+b1 and also confirm that re-compiling it with the upstream patch makes it work correctly.
--- qemu-2.5+dfsg.orig/block.c +++ qemu-2.5+dfsg/block.c @@ -2028,7 +2028,7 @@ static void change_parent_backing_link(B } if (from->blk) { blk_set_bs(from->blk, to); - if (!to->device_list.tqe_prev) { + if (!to->device_list.tqe_prev || !*to->device_list.tqe_prev) { QTAILQ_INSERT_BEFORE(from, to, device_list); } QTAILQ_REMOVE(&bdrv_states, from, device_list); - Michel