Possible bug in qemu-0.12.4 on Linux, and I think applicable to qemu-0.12.5
The VNC reverse connection option appears to be parsed correctly, however, the handling of the VncDisplay structure leads to a segfault: Command line: ./i386-softmmu/qemu -vnc <ipaddress>:9990,reverse -usb -monitor stdio ~/vmimg/linux-0.2.img I took the liberty of hiding the ip address to protect the innocent ;-) Error: Switching to Thread 0x7fd99ceb06e0 (LWP 15174)] 0x00000000004fa5df in vnc_refresh_server_surface (vd=0xd40e50) at vnc.c:2262 2262 guest_row = vd->guest.ds->data; Backtrace: (gdb) bt #0 0x00000000004fa5df in vnc_refresh_server_surface (vd=0xd40e50) at vnc.c:2262 #1 0x00000000004fa872 in vnc_refresh (opaque=0xd40e50) at vnc.c:2303 #2 0x00000000004fa9aa in vnc_init_timer (vd=0xd40e50) at vnc.c:2334 #3 0x00000000004fab2d in vnc_connect (vd=0xd40e50, csock=0xc) at vnc.c:2377 #4 0x00000000004fb226 in vnc_display_open (ds=0xc97b20, display=0x7fffffffd871 "<ipaddress>:9990,reverse") at vnc.c:2674 #5 0x000000000040fd1d in main (argc=0x9, argv=0x7fffffffb9c8, envp=0x7fffffffba18) at /home/d/qemu/vl.c:6127 (gdb) p *vd $2 = { timer = 0xcabbc0, timer_interval = 0x1e, lsock = 0xffffffff, ds = 0xc97b20, clients = 0xd82a10, kbd_layout = 0xcbf010, guest = { dirty = {{0x0, 0x0, 0x0, 0x0} <repeats 2048 times>}, ds = 0x0 }, server = 0x0, display = 0xcb5f90 "<ipaddress>:9990,reverse", password = 0x0, auth = 0x1 } I'm going through the code to make sure I'm using the appropriate option for a reverse VNC, but assuming I got that right I will then look to see if there's a patch I might submit to fix this. However, if someone else has already seen it... Cheers, David