control: tags -1 + fixed-upstream patch Upstream commit bcf3c55531349dfec135cad9bf359960214dd0f6 (xen: Fix wrong register in relocator) solves the problem for me. It applies cleanly to jessie-security's version of grub2.