untrusted comment: verify with openbsd-72-base.pub
RWQTKNnK3CZZ8ACZ2Ps/1t1I3ToKTM07KgWnlw2zsKcNjGFYkDh057PamSmmjFqEx9fjykoiE4GTC1x2eFHd4dL9A4vUcbs+YgQ=

OpenBSD 7.2 errata 015, January 21, 2023:

vmm(4) exposed unsupported cpuid feature flags to guests.

Apply by doing:
   signify -Vep /etc/signify/openbsd-72-base.pub -x 015_vmm.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
   KK=`sysctl -n kern.osversion | cut -d# -f1`
   cd /usr/src/sys/arch/`machine`/compile/$KK
   make obj
   make config
   make
   make install

Index: sys/arch/amd64/amd64/vmm.c
===================================================================
RCS file: /cvs/src/sys/arch/amd64/amd64/vmm.c,v
diff -u -p -u -r1.323.2.1 vmm.c
--- sys/arch/amd64/amd64/vmm.c  23 Nov 2022 19:48:36 -0000      1.323.2.1
+++ sys/arch/amd64/amd64/vmm.c  19 Jan 2023 15:22:07 -0000
@@ -7062,7 +7062,8 @@ vmm_handle_cpuid(struct vcpu *vcpu)
               if (subleaf == 0) {
                       *rax = 0;       /* Highest subleaf supported */
                       *rbx = curcpu()->ci_feature_sefflags_ebx & VMM_SEFF0EBX_MASK;
-                       *rcx = curcpu()->ci_feature_sefflags_ecx & VMM_SEFF0ECX_MASK;
+#define VMM_SEFF0ECX_MASK_T (SEFF0ECX_UMIP)
+                       *rcx = curcpu()->ci_feature_sefflags_ecx & VMM_SEFF0ECX_MASK_T;
                       *rdx = curcpu()->ci_feature_sefflags_edx & VMM_SEFF0EDX_MASK;
               } else {
                       /* Unsupported subleaf */