I cannot get QEMU 9.1 to send semihosting to a character device. It always prints it to standard out.

```bash
qemu-system-arm -cpu cortex-m4 -machine mps2-an386 \
  -kernel ./target/thumbv7em-none-eabihf/debug/uart_buffered \
  -chardev socket,id=foo,host=localhost,port=8000 \
  -chardev socket,id=bar,host=localhost,port=8001 \
  -serial chardev:foo \
  -semihosting \
  -semihosting-config chardev=bar,target=native \
  -nographic
```

That should send semihosting data to `bar`, which is a remote TCP server on localhost:8000. But it does not.

What am I doing wrong? Does this work for anyone else?