https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83994
--- Comment #2 from Florian Weimer <fw at gcc dot gnu.org> --- It's still callee-saved, so it is picked by get_scratch_register_on_entry if it is saved by the function, under the assumption that it is used only after the prologue has saved it and there is no need to save and restore it separately. (At least that's my understanding of the issue.)