JIT unsoundness with recursive function [in 8.6beta3 and 8.5.x]

Description

The following code:

<?php
declare(strict_types=1);

function checkWord(string $board, string $word, int $pos, int $idxChar = 0, int $usedBitboard = 0): bool
{
    error_log("checkWord($board, $word, $pos, $idxChar, $usedBitboard)");
    if ($pos < 0) {
        error_log("--- pos = $pos");
        throw new \Exception('impossible, $pos cannot be negative, yet it is.');
    }
    if ($board[$pos] != $word[$idxChar]) {
        return false;
    }
    if ($idxChar == strlen($word) - 1) {
        return true;
    }
    $newUsedBitboard = $usedBitboard | (1 << $pos);
    $x = $pos & 0b11;
    $y = $pos >> 2;
    for ($dy = -1; $dy <= 1; ++$dy) {
        for ($dx = -1; $dx <= 1; ++$dx) {
            if (($dx == 0) and ($dy == 0)) {
                continue;
            }
            $newX = $x + $dx;
            $newY = $y + $dy;
            if (($newX < 0) or ($newX >= 4) or ($newY < 0) or ($newY >= 4)) {
                continue;
            }
            $newPos = ($newY << 2) | $newX;
            if (($newUsedBitboard & (1 << $newPos)) != 0) {
                continue;
            }
            if (checkWord($board, $word, $newPos, $idxChar + 1, $newUsedBitboard)) {
                return true;
            }
        }
    }
    return false;
}

// ---------- main program
$board = 'RANRTHCTBTEAEOTN';
$notepad_input = [
    'BETTER HEN EACH TORT TOE CANT TEA HEAT HAT TRACE TRACT TOT TAR ETA TAR TAN TOTE CHART TENT CAT CHART TOTE TEA ACE ART TRANCE TOT CANE CHART CAN CHAT CANT THEN NET TRACE BOTH HERE',
    'BOTH CHAT EACH CAT CENT CANE TEA CART ANTE TORCH HET RANT ACT TOE ACT HAT TOE CHAT BOTH CANE CART BOTH TEACH EACH NET ACE TEA BET THAT BETH ACT EACH RAT EAR CHEAT ETA TAN ACT CANE ANT TECH TENT EAT TEA ATE CAN THAT THETA',
    'HEAT HAT TOTE NEAT RANCH CAN THEN THEN THE BET ATE RAN THAT TOTE TENT EACH CENT TERRACE HAT CAR TEA BOTH CAT CENT CAR BETH ANT HEN HEAT CENT TECH ANT BOTH',
    'CANT ANT TRACT THAT THEN CHAR TRACE THAT HEAT RAT RAN HAT CAR THE THETA CHEAT CHART ETA ANCHOR',
];
$notepads = [];
$wordToWriter = [];
for ($i = 0; $i < 4; ++$i) {
    $notepads[$i] = explode(' ', $notepad_input[$i]);
    foreach ($notepads[$i] as $j => $word) {
        if (!isset($wordToWriter[$word])) {
            $wordToWriter[$word] = [$i => [$j]];
        } elseif (!isset($wordToWriter[$word][$i])) {
            $wordToWriter[$word][$i] = [$j];
        } else {
            $wordToWriter[$word][$i][] = $j;
        }
    }
}
// in the loop below sometimes Exception thrown when invoking: checkWord($board, 'TAR', 4);
for ($i = 0; $i < 4; ++$i) {
    foreach ($notepads[$i] as $j => $word) {
        if ((count($wordToWriter[$word] ?? []) <= 1) && ($wordToWriter[$word][$i][0] == $j)) {
            for ($pos = 0; $pos < 16; ++$pos) {
                if (checkWord($board, $word, $pos)) {
                    break;
                }
            }
        }
    }
}
echo '-- it works, no Exception thrown' . PHP_EOL;

Resulted in this output:

PHP Fatal error:  Uncaught Exception: impossible, $pos cannot be negative, yet it is.

But I expected this output instead:

-- it works, no Exception thrown

When running with JIT enabled, the code fails with 8.5.x and also with 8.6.beta3 and earlier. It works fine with JIT disabled. It also works fine with 8.3.33 even with JIT enabled..

Sorry for the complicated code, I had very hard time trying to simplify it while keeping the bug.
Behaviour is strange: sometimes even just commenting out the "error_log()" at the beginning of the function changed the result. Sometimes saving the file and rerunning twice resulted 1st OK, then failure (even if code is 100% deterministic).
Recursion might be a factor in the bug.

PHP Version

PHP 8.5.10 (cli) (built: Aug 25 2026 21:21:19) (ZTS Visual C++ 2022 x64)
Copyright (c) The PHP Group
Built by The PHP Group
Zend Engine v4.5.10, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.10, Copyright (c), by Zend Technologies
---
PHP 8.6.0beta3 (cli) (built: Sep  8 2026 17:36:07) (ZTS Visual C++ 2026 x64)
Copyright © The PHP Group and Contributors
Built by The PHP Group
Zend Engine v4.6.0-dev, Copyright © Zend by Perforce
    with Zend OPcache v8.6.0beta3, Copyright ©, by Zend by Perforce

Operating System

Windows 11 [reported as 10.0.26200.9445]