I'm actually fuzzing qemu's block device layer as we speak.

From the latest run:

    │        run time : 11 days, 23 hrs, 12 min, 49 sec    │  cycles done : 0      │
    │   last new path : 0 days, 12 hrs, 55 min, 7 sec      │  total paths : 364    │
    │ last uniq crash : none seen yet                      │ uniq crashes : 0      │
    │  last uniq hang : 0 days, 4 hrs, 4 min, 36 sec       │   uniq hangs : 2      │

Re the comparison with Xen's qemu, you can grab the sources for RHEL's qemu-kvm and qemu-kvm-rhev packages and examine the driver whitelists, patches and ./configure line yourself.