The VMCS contains a field that is set to 1 to indicate that there is a pending HLT. In this state, vmxrun will still HLT on resume even if, e.g., the RIP has been updated to point to a different instruction. VMMs are required to explicitly clear this field after a VMexit due to a HLT if the processor should resume. See also: https://www.illumos.org/issues/15079
I got the sense backwards in my description. VM exits due to HLT are fine, it's when the vCPU exits for some other reason while HLTed that the field in the VMCS is set and needs to be reset before resuming.