Paolo Bonzini [off-list ref] writes:

Instead, VIRTIO_NET_F_HOST_MUST_SEND_GARP would be a "negative" feature:
if set, the host _may not_ rely on the guest to send a gARP.  Similarly
if VIRTIO_BALLOON_F_MUST_TELL_HOST is set, the guest _may not_ use
ballooned pages directly.

There are _no_ other negative features besides
VIRTIO_BALLOON_F_MUST_TELL_HOST in the spec, and for a good
reason---because they're broken.

(Hmm, actually we have one, VIRTIO_BLK_F_RO.  It is also a bit broken,
but it is not so important because it depends on user input more than
hypervisor version).

Yes, this is the key observation, and an important lesson for the
future.  Thanks!

Note that these two negative features were in the original spec, where
it's assumed that every device supports them.  That's not explicitly
documented, however.

I like killing the totally unused feature.

Cheers,
Rusty.