In X's vmmouse_drv, the magic number is defined as uint32_t. Therefore the top half of the 64 bit ax register is garbage that should be ignored. This makes fc6 guest's vmmouse work.
Index: hw/vmport.c =================================================================== RCS file: /sources/qemu/qemu/hw/vmport.c,v retrieving revision 1.1 diff -u -p -r1.1 vmport.c --- hw/vmport.c 26 Aug 2007 17:48:12 -0000 1.1 +++ hw/vmport.c 8 Oct 2007 13:11:45 -0000 @@ -55,7 +55,7 @@ static uint32_t vmport_ioport_read(void target_ulong eax; eax = s->env->regs[R_EAX]; - if (eax != VMPORT_MAGIC) + if ((uint32_t)eax != VMPORT_MAGIC) return eax; command = s->env->regs[R_ECX];