1. If vEOI happens for a masked vIRQ, notify resamplefd as usual,
but also remember this vIRQ as, let's call it, "pending oneshot".
2. A new physical IRQ is immediately generated, so the vIRQ is
properly set as pending.
3. After the vIRQ is unmasked by the guest, check and find out that
it is not just pending but also "pending oneshot", so don't
deliver it to a vCPU. Instead, immediately notify resamplefd once
again.
In other words, don't avoid extra physical interrupts in the host
(rather, use those extra interrupts for properly updating the pending
state of the vIRQ) but avoid propagating those extra interrupts to the
guest.
Does this sound reasonable to you?