Novas core seems to be formally verified which rules out a vast amount of bug categories that can happen with xen, including this one