The bug is present since commit 06fc7772690d ("KVM: SVM: Activate nested
state only when guest state is complete", 2010-04-25). Unfortunately,
it is not clear from the commit message what issue exactly led to the
change back then. It was probably related to svm_set_cr0 however because
the patch series cover letter[1] mentioned lazy FPU switching.
Aha! It was indeed related to svm_set_cr0(). Specifically, the next patch,
commit 66a562f7e257 ("KVM: SVM: Make lazy FPU switching work with nested svm"),
added is_nested() checks in update_cr0_intercept() to merge L1's intercepts with
L0's intercepts.