Found and reported by Vaibhav Choudhary (vaibhav):
https://www.linkedin.com/posts/vaibhavchoudhary_java-openjdk-valhalla-activity-7393599434619719680-AQow/

Attached LocalityCheck.java crashes the JVM.

java --enable-preview LocalityCheck.java

# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x0000775697ec5a7b, pid=877364, tid=877411
#
# JRE version: Java(TM) SE Runtime Environment (26.0) (fastdebug build 26-jep401ea2-tobias.open)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 26-jep401ea2-tobias.open, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0x10c5a7b] InlineKlass::is_payload_marked_as_null(unsigned char*)+0x2b

Stack: [0x00007756555f8000,0x00007756556f8000], sp=0x00007756556f6230, free space=1016k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x10c5a7b] InlineKlass::is_payload_marked_as_null(unsigned char*)+0x2b (inlineKlass.hpp:162)
V [libjvm.so+0x10c0627] InlineKlass::read_payload_from_addr(oop, int, LayoutKind, JavaThread*)+0x77 (inlineKlass.cpp:234)
V [libjvm.so+0x70138e] flatArrayOopDesc::obj_at(int, JavaThread*) const+0x38e (flatArrayOop.inline.hpp:60)
V [libjvm.so+0x1125524] InterpreterRuntime::flat_array_load(JavaThread*, arrayOopDesc*, int)+0x134 (interpreterRuntime.cpp:281)
j java.util.Spliterators$ArraySpliterator.forEachRemaining(Ljava/util/function/Consumer;)V+52 java.base@26-jep401ea2
J 1508 c1 java.util.stream.AbstractPipeline.copyInto(Ljava/util/stream/Sink;Ljava/util/Spliterator;)V java.base@26-jep401ea2 (54 bytes) @ 0x0000775678662d5c [0x00007756786628a0+0x00000000000004bc]
J 1348 c1 java.util.stream.AbstractPipeline.wrapAndCopyInto(Ljava/util/stream/Sink;Ljava/util/Spliterator;)Ljava/util/stream/Sink; java.base@26-jep401ea2 (18 bytes) @ 0x00007756785f83a4 [0x00007756785f80a0+0x0000000000000304]
j java.util.stream.ReduceOps$ReduceTask.doLeaf()Ljava/util/stream/ReduceOps$AccumulatingSink;+15 java.base@26-jep401ea2
j java.util.stream.ReduceOps$ReduceTask.doLeaf()Ljava/lang/Object;+1 java.base@26-jep401ea2

Also crashes with -Xint:

java --enable-preview -Xint LocalityCheck.java

# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x000076cac73d2d82, pid=877454, tid=877455
#
# JRE version: Java(TM) SE Runtime Environment (26.0) (fastdebug build 26-jep401ea2-tobias.open)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 26-jep401ea2-tobias.open, interpreted mode, sharing, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0x15d2d82]

Stack: [0x000076cac8500000,0x000076cac8600000], sp=0x000076cac85fdf38, free space=1015k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x15d2d82]
j java.util.stream.Nodes$FixedNodeBuilder.accept(Ljava/lang/Object;)V+28 java.base@26-jep401ea2
j java.util.stream.IntPipeline$1$1.accept(I)V+14 java.base@26-jep401ea2
j java.util.stream.Streams$RangeIntSpliterator.forEachRemaining(Ljava/util/function/IntConsumer;)V+44 java.base@26-jep401ea2
j java.util.Spliterator$OfInt.forEachRemaining(Ljava/util/function/Consumer;)V+12 java.base@26-jep401ea2
j java.util.stream.AbstractPipeline.copyInto(Ljava/util/stream/Sink;Ljava/util/Spliterator;)V+32 java.base@26-jep401ea2
j java.util.stream.AbstractPipeline.wrapAndCopyInto(Ljava/util/stream/Sink;Ljava/util/Spliterator;)Ljava/util/stream/Sink;+13 java.base@26-jep401ea2
j java.util.stream.AbstractPipeline.evaluate(Ljava/util/Spliterator;ZLjava/util/function/IntFunction;)Ljava/util/stream/Node;+32 java.base@26-jep401ea2
j java.util.stream.AbstractPipeline.evaluateToArrayNode(Ljava/util/function/IntFunction;)Ljava/util/stream/Node;+74 java.base@26-jep401ea2
j java.util.stream.ReferencePipeline.toArray(Ljava/util/function/IntFunction;)[Ljava/lang/Object;+4 java.base@26-jep401ea2
j LocalityCheck.main([Ljava/lang/String;)V+23