oh, this sounds like an exciting Xen >=4.17 bug affecting HVM/PVH modes:
"Use after free of paging structures in EPT"
https://xenbits.xen.org/xsa/advisory-480.html