vhost: send userfault range addresses back to Qemu