https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86040
--- Comment #3 from Georg-Johann Lay <gjl at gcc dot gnu.org> --- ...and here is code that triggers the wrong path of the 2-byte case: typedef struct S { const __flash2 struct S *p; struct S *q; } S; const __flash2 S* func2 (const S *s) { return s->p->q->p; } $ avr-gcc -std=gnu99 -mmcu=atxmega128a1 -S foo.c -Os -dp func2: movw r26,r24 ; 20 [c=4 l=1] *movhi/0 ld r30,X+ ; 6 [c=8 l=2] *movhi/2 ld r31,X adiw r30,2 ; 8 [c=4 l=1] addhi3_clobber/0 ldi r18,2 ; 9 [c=8 l=5] *movhi/2 out __RAMPZ__,r18 elpm r0,Z+ elpm r31,Z mov r30,r0 ld r24,Z ; 15 [c=8 l=2] *movhi/2 ldd r25,Z+1 /* epilogue start */ ret ; 23 [c=0 l=1] return Insn 9 is missing the reset of RAMPZ so that insn 15 loads with a high-byte of 2.