diff --git a/2df5c1f5b014126595a26c6797089d284a3b211c.patch b/2df5c1f5b014126595a26c6797089d284a3b211c.patch
new file mode 100644
index 0000000..9de4a50
--- /dev/null
+++ b/2df5c1f5b014126595a26c6797089d284a3b211c.patch
@@ -0,0 +1,82 @@
+From 2df5c1f5b014126595a26c6797089d284a3b211c Mon Sep 17 00:00:00 2001
+From: Harsh Prateek Bora <harshpb@linux.ibm.com>
+Date: Wed, 24 Jan 2024 10:30:55 +1000
+Subject: [PATCH] ppc/spapr: Introduce SPAPR_IRQ_NR_IPIS to refer IRQ range for
+ CPU IPIs.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+spapr_irq_init currently uses existing macro SPAPR_XIRQ_BASE to refer to
+the range of CPU IPIs during initialization of nr-irqs property.
+It is more appropriate to have its own define which can be further
+reused as appropriate for correct interpretation.
+
+Suggested-by: Cedric Le Goater <clg@kaod.org>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Tested-by: Kowshik Jois <kowsjois@linux.ibm.com>
+Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+---
+ hw/ppc/spapr_irq.c         |  6 ++++--
+ include/hw/ppc/spapr_irq.h | 14 +++++++++++++-
+ 2 files changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/hw/ppc/spapr_irq.c b/hw/ppc/spapr_irq.c
+index a0d1e1298e1e..97b2fc42ab03 100644
+--- a/hw/ppc/spapr_irq.c
++++ b/hw/ppc/spapr_irq.c
+@@ -23,6 +23,8 @@
+ 
+ #include "trace.h"
+ 
++QEMU_BUILD_BUG_ON(SPAPR_IRQ_NR_IPIS > SPAPR_XIRQ_BASE);
++
+ static const TypeInfo spapr_intc_info = {
+     .name = TYPE_SPAPR_INTC,
+     .parent = TYPE_INTERFACE,
+@@ -329,7 +331,7 @@ void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
+         int i;
+ 
+         dev = qdev_new(TYPE_SPAPR_XIVE);
+-        qdev_prop_set_uint32(dev, "nr-irqs", smc->nr_xirqs + SPAPR_XIRQ_BASE);
++        qdev_prop_set_uint32(dev, "nr-irqs", smc->nr_xirqs + SPAPR_IRQ_NR_IPIS);
+         /*
+          * 8 XIVE END structures per CPU. One for each available
+          * priority
+@@ -356,7 +358,7 @@ void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
+     }
+ 
+     spapr->qirqs = qemu_allocate_irqs(spapr_set_irq, spapr,
+-                                      smc->nr_xirqs + SPAPR_XIRQ_BASE);
++                                      smc->nr_xirqs + SPAPR_IRQ_NR_IPIS);
+ 
+     /*
+      * Mostly we don't actually need this until reset, except that not
+diff --git a/include/hw/ppc/spapr_irq.h b/include/hw/ppc/spapr_irq.h
+index c22a72c9e270..4fd2d5853d8b 100644
+--- a/include/hw/ppc/spapr_irq.h
++++ b/include/hw/ppc/spapr_irq.h
+@@ -14,9 +14,21 @@
+ #include "qom/object.h"
+ 
+ /*
+- * IRQ range offsets per device type
++ * The XIVE IRQ backend uses the same layout as the XICS backend but
++ * covers the full range of the IRQ number space. The IRQ numbers for
++ * the CPU IPIs are allocated at the bottom of this space, below 4K,
++ * to preserve compatibility with XICS which does not use that range.
++ */
++
++/*
++ * CPU IPI range (XIVE only)
+  */
+ #define SPAPR_IRQ_IPI        0x0
++#define SPAPR_IRQ_NR_IPIS    0x1000
++
++/*
++ * IRQ range offsets per device type
++ */
+ 
+ #define SPAPR_XIRQ_BASE      XICS_IRQ_BASE /* 0x1000 */
+ #define SPAPR_IRQ_EPOW       (SPAPR_XIRQ_BASE + 0x0000)
diff --git a/qemu.spec b/qemu.spec
index b3e83f5..df42a64 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -401,6 +401,7 @@ Patch: qemu-fifreeze-fithaw.patch
 
 # ppc/spapr: Initialize max_cpus limit to SPAPR_IRQ_NR_IPIS
 # https://bugzilla.redhat.com/show_bug.cgi?id=2265982
+Patch: https://github.com/qemu/qemu/commit/2df5c1f5b014126595a26c6797089d284a3b211c.patch
 Patch: https://github.com/qemu/qemu/commit/c4f91d7b7be76c47015521ab0109c6e998a369b0.patch
 
 Source10: qemu-guest-agent.service
@@ -3169,7 +3170,7 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 
 %changelog
 * Mon Feb 26 2024 Richard W.M. Jones <rjones@redhat.com> - 2:8.2.0-9
--  Backport ppc/spapr: Initialize max_cpus limit to SPAPR_IRQ_NR_IPIS
+- ppc/spapr: Initialize max_cpus limit to SPAPR_IRQ_NR_IPIS (RHBZ#2265982)
 
 * Wed Feb 21 2024 Richard W.M. Jones <rjones@redhat.com> - 2:8.2.0-8
 - Fix user-emulation of FIFREEZE and FITHAW ioctls