qemu invalid tss type

Question

I am switching to user mode from kernel mode in 32-bit protected mode (only segmentation not paging). When I make the switch and call an interrupt in userspace I get this error from QEMU:

This may indicate that pixbuf loaders or the mime database could not be found.
qemu: fatal: invalid tss type
EAX=00003fec EBX=00001000 ECX=00000002 EDX=00001810
ESI=00000000 EDI=00000000 EBP=00003ff8 ESP=00003fec
EIP=00000000 EFL=00000006 [-----P-] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =0023 00006000 7fffffff 00c7f300 DPL=3 DS   [-WA]
CS =001b 00006000 7fffffff 00c7fa00 DPL=3 CS32 [-R-]
SS =0023 00006000 7fffffff 00c7f300 DPL=3 DS   [-WA]
DS =0023 00006000 7fffffff 00c7f300 DPL=3 DS   [-WA]
FS =0023 00006000 7fffffff 00c7f300 DPL=3 DS   [-WA]
GS =0023 00006000 7fffffff 00c7f300 DPL=3 DS   [-WA]
LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT
TR =0000 00000000 0000ffff 00008b00 DPL=0 TSS32-busy
GDT=     00007c47 00000027
IDT=     00003000 0000ffff
CR0=00000011 CR2=00000000 CR3=00000000 CR4=00000000
DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000
DR6=ffff0ff0 DR7=00000400
CCS=00000004 CCD=00003fe8 CCO=EFLAGS
EFER=0000000000000000
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000

Here is the code that switches to user space:

switchSegments:
    
    mov ax, 0x23
    mov ds, ax
    mov es, ax
    mov fs, ax
    mov gs, ax

    mov eax, esp
    push dword 0x23
    push dword eax
    pushf
            
    push dword 0x1B
    push dword 0x0
    iret

Here is the GDT:

gdt_start:
    ;first entry is always null (each entry is 8 bytes or 64 bits)
    dd 0x0 ; 4 byte
    dd 0x0 ; 4 byte

; GDT for code segment. base = 0x00000000, length = 0xfffff
; for flags, refer to os-dev.pdf document, page 36
gdt_code: 
    dw 0xFFFF   ; segment length, bits 0-15
    dw 0x0       ; segment base, bits 0-15
    db 0x0       ; seg2ment base, bits 16-23
    db 10011010b ; flags (8 bits)
    db 11000000b ; flags (4 bits) + segment length, bits 16-19
    db 0x0       ; segment base, bits 24-31

; GDT for data segment. base and length identical to code segment
; some flags changed, again, refer to os-dev.pdf
gdt_data:
    dw 0xFFFF
    dw 0x0
    db 0x0
    db 10010010b
    db 11000000b
    db 0x0

U_code: 
    dw 0xFFFF    ; segment length, bits 0-15
    dw 0x6000    ; segment base, bits 0-15
    db 0x00      ; seg2ment base, bits 16-23
    db 11111010b ; flags (8 bits)
    db 11000111b ; flags (4 bits) + segment length, bits 16-19
    db 0x00       ; segment base, bits 24-31

; GDT for data segment. base and length identical to code segment
; some flags changed, again, refer to os-dev.pdf
U_data:
    dw 0xFFFF
    dw 0x6000
    db 0x00
    db 11110010b
    db 11000111b
    db 0x00


tssSegment:
    dw tssend - tss
    dw tss
    db 0x0
    db 0x89
    db 0x40
    db 0x0 

gdt_end:

; GDT descriptor
gdt_descriptor:
    dw gdt_end - gdt_start - 1 ; size (16 bit), always one less of its true size
    dd gdt_start ; address (32 bit)

I am calling the interrupt with int 2 from user space.

I'm not quite sure what invalid TSS means. I am not using paging for memory protection. Why am I getting this error and how can I fix it?

UPDATE 1

How does this TSS looks?

tss:
    dd 0x0
    
    dd 0x4000 ;esp0
    dd 0x10 ;ss0
    
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0
    dd 0x0

    dd 104 ;IOPB

    dd 0x0
tssend: