I experienced a similar problem that was related to nested code
having some bugs related to apicv and other new vmx features.
For example, the code enabled posted interrupts to run L2 even when the
feature was not exposed to L1 and L1 didn't use it.
Try changing prepare_vmcs02 to force disabling posted_interrupts,
code should looks like:
....
....
exec_control = vmcs12->pin_based_vm_exec_control;
exec_control |= vmcs_config.pin_based_exec_ctrl;
exec_control &= ~(PIN_BASED_VMX_PREEMPTION_TIMER|PIN_BASED_POSTED_INTR);
vmcs_write32(PIN_BASED_VM_EXEC_CONTROL, exec_control);
....
...
and also
...
...
exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
SECONDARY_EXEC_APIC_REGISTER_VIRT |
SECONDARY_EXEC_PAUSE_LOOP_EXITING);