I have some information to go on:
The problem occurs because of a failed call to rom_copy from hw/i386/multiboot.c
I print debugged some values:
ELF_LOW: 0x100000
ELF_HIGH: 0x14c578
MH_LOAD_ADDR: 0x100000
MH_KERNEL_SIZE: 0x4c578
MH_ENTRY_ADDR: 0x10000c
COPY SIZE: 0x4210
The return value from rom_copy (found in hw/core/loader.c) is compared with mh_kernel_size to see they are the same. If they are not qemu will exit and print the error message I got. As you can see in this printout mh_kernel_size is 0x4c578 and the return value was 0x4210. Now something goes wrong here. I suspect it doesnt take into the account that there can be more program headers for elf so it just takes the first one.
So to confirm this I ran readelf -a fudge I get this information about my binary:
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x001000 0x00100000 0x00100000 0x04210 0x04210 R E 0x1000
LOAD 0x006000 0x00105000 0x00105000 0x00000 0x47578 RW 0x1000
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x4
As you can see the MemSiz field contains the value 0x4210 meaning rom_copy only copys the first program header but not the second causing this problem.
I will try to see if I can fix this so that qemu takes into account all program headers.
// Jens