The situation is even worse than I have feared.
Thanks for finding this!
Well, if qcow2_get_specific_info() is the only place that can actually
cause issues in that case (i.e. calling some QMP function which uses the
qcow2 image while the incoming_migration coroutine yields before the
image has been fully reopened), I think the simplest way to fix this
would be to just return NULL from qcow2_get_specific_info() in the else
branch (which currently aborts), adding a comment how we can end up there.
However, it seems hard to believe this is the only problematic path...
If the coroutine can yield between the BDRVQcow2State getting memset()
to 0 and qcow2_open() having initialized it again, then any QMP command
which makes use of the qcow2 image should fail (not necessarily
gracefully) at that point.