KVM: inject NMI after IRET from a previous NMI, not before.