Index: qemu/block.c
===================================================================
--- qemu.orig/block.c	2010-01-26 10:59:39.757004445 +0100
+++ qemu/block.c	2010-01-26 11:01:38.056023231 +0100
@@ -1689,6 +1689,10 @@ static int multiwrite_merge(BlockDriverS
             merge = bs->drv->bdrv_merge_requests(bs, &reqs[outidx], &reqs[i]);
         }
 
+        if (reqs[outidx].qiov->niov + reqs[i].qiov->niov + 1 > IOV_MAX) {
+            merge = 0;
+        }
+
         if (merge) {
             size_t size;
             QEMUIOVector *qiov = qemu_mallocz(sizeof(*qiov));
Index: qemu/qemu-common.h
===================================================================
--- qemu.orig/qemu-common.h	2010-01-26 14:41:40.894254285 +0100
+++ qemu/qemu-common.h	2010-01-26 14:42:27.267275698 +0100
@@ -54,6 +54,10 @@ struct iovec {
     void *iov_base;
     size_t iov_len;
 };
+/*
+ * Use the same value as Linux for now.
+ */
+#define IOV_MAX		1024
 #else
 #include <sys/uio.h>
 #endif