The qemu command line contains 2x the "-cpu" parameter. The first one sets the CPU to host,aarch64=off the second one to -cpu host which disables the aarch64=off flag. If I boot the kernel without the second -cpu host, it works for me locally.