https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119958
--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> --- This is in tls.pdf documented 0x00 movq %fs:0,%rax 0x09 addq x@gottpoff(%rip),%rax R_X86_64_GOTTPOFF x ⇓⇓⇓ 0x00 movq %fs:0,%rax 0x09 leaq x@tpoff(%rax),%rax R_X86_64_TPOFF32 x IE->LE relaxation, which is based on relocations, not on analyzing the code. So, it is gcc's fault that it attempts to use flags set by the addq.
