I actually found an Intel Ice Lake bug (on a MacBook Air) like this, but unfortunately I could not claim a bounty since I wasn't the first. A number of people found it independently.

https://bugs.openjdk.java.net/browse/JDK-8248315

I don't think anyone found a way to trigger it via JavaScript but it was easy to reproduce for some reason via the JVM. AFAIK Intel never released exactly what it was, just a microcode update.

X64 has a horrifically complex legacy encoding and tons of extensions including many that are obsolete but still supported. It really lends itself to these kinds of bugs.

Every mature architecture including ARM/ARM64 has cruft, but X86/X64 is particularly bad.