Third resent of this series after this didn't get picked up the previous times. The Qemu NVMe implementation mistakes the cns field in the Identify command as a boolean. This was never true, and is actively harmful since NVMe1.1 (which the Qemu device claims to support) supports more than two Identify variants.
We had to add a quirk in Linux to work around this behavior.