A flaw was found in the USB CCID (smartcard reader) device emulation (hw/usb/dev-smartcard-reader.c) in QEMU. For each PC_to_RDR_XfrBlock APDU received from the guest, ccid_on_apdu_from_guest() queues a pending answer without checking whether the slot is already busy. A guest that submits XfrBlock messages faster than the asynchronous card backend can process them can overflow the 128-entry pending-answers ring buffer, triggering an assertion failure in ccid_add_pending_answer() that aborts the QEMU process. This may result in a denial of service of the QEMU process. The flaw was introduced in QEMU 0.15.0 and fixed in 11.1.3 and 10.0.15.