To reproduce:
* add INHERIT += "rm_work" to local.conf
* build an image
* "runqemu" for that image

It fails with:

runqemu - INFO - Assuming MACHINE = intel-corei7-64
runqemu - INFO - Running MACHINE=intel-corei7-64 bitbake -e...
runqemu - INFO - MACHINE: intel-corei7-64
runqemu - INFO - DEPLOY_DIR_IMAGE: /fast/build/refkit/intel-corei7-64/tmp-glibc/deploy/images/intel-corei7-64
runqemu - INFO - CONFFILE: /fast/build/refkit/intel-corei7-64/tmp-glibc/deploy/images/intel-corei7-64/refkit-installer-image-intel-corei7-64.qemuboot.conf
runqemu - INFO - Overriding conf file setting of STAGING_DIR_NATIVE to /fast/build/refkit/intel-corei7-64/tmp-glibc/work/corei7-64-refkit-linux/defaultpkgname/1.0-r0/recipe-sysroot-native from Bitbake environment
runqemu - INFO - Overriding conf file setting of STAGING_BINDIR_NATIVE to /fast/build/refkit/intel-corei7-64/tmp-glibc/work/corei7-64-refkit-linux/defaultpkgname/1.0-r0/recipe-sysroot-native/usr/bin from Bitbake environment
runqemu - INFO - Continuing with the following parameters:

MACHINE: [intel-corei7-64]
FSTYPE: [wic]
...
runqemu - INFO - Running /bin/ip link...
runqemu - INFO - Setting up tap interface under sudo
runqemu - INFO - Acquiring lockfile /tmp/qemu-tap-locks/Error: Unable to find tunctl binary in '/fast/build/refkit/intel-corei7-64/tmp-glibc/work/corei7-64-refkit-linux/defaultpkgname/1.0-r0/recipe-sysroot-native/usr/bin', please bitbake qemu-helper-native.lock...

It fails because the sysroot dirs of the image get removed by do_rm_work, causing the fallback code to get triggered:

        # If the STAGING_*_NATIVE directories from the config file don't exist
        # and we're in a sourced OE build directory try to extract the paths
        # from `bitbake -e`
        havenative = os.path.exists(self.get('STAGING_DIR_NATIVE')) and \
            os.path.exists(self.get('STAGING_BINDIR_NATIVE'))

        if not havenative:
            <broken code follows>

That entire code section needs to be rewritten, it can no longer work with RSS.

Probably need to do something similar to wic-tools. Instead of installing the qemu tools into the sysroot of each image, install them into the sysroot of a shared recipe (qemu-tools?) and use them from there. Perhaps unify with how the qemu binary itself is handled? Just my 2 cents.