https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116199
--- Comment #4 from Jeffrey A. Law <law at gcc dot gnu.org> --- Definitely a latent bug in reload. Looks like it's been around since the conversion to SUBREG_BYTE back in 2001! We're blindly using subreg_regno_offset on a case that can't be simplified. We should be checking simplify_subreg_regno first.