diff --git a/NEWS b/NEWS
index b37e5fb8d8a..140069448e0 100644
--- a/NEWS
+++ b/NEWS
@@ -71,6 +71,8 @@ PHP                                                                        NEWS
     is reloaded from memory). (ndossche)
   . Fixed bug GH-24386 (JIT: register operand must be loaded before the typed
     reference check). (ndossche)
+  . Fixed bug GH-24437 (JIT: Fix OP_DATA read from an unwritten slot in
+    zend_jit_assign_dim_op()). (waroad)
 
 - PDO:
   . Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.
diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
index df0b10344e8..78e7c94cea2 100644
--- a/ext/opcache/jit/zend_jit_ir.c
+++ b/ext/opcache/jit/zend_jit_ir.c
@@ -13670,9 +13670,10 @@ static int zend_jit_assign_dim_op(zend_jit_ctx   *jit,
 						if (!zend_jit_spill_store_inv(jit, op3_addr, real_addr, op1_data_info)) {
 							return 0;
 						}
-						op3_addr = real_addr;
+						arg2 = jit_ZVAL_ADDR(jit, real_addr);
+					} else {
+						arg2 = jit_ZVAL_ADDR(jit, op3_addr);
 					}
-					arg2 = jit_ZVAL_ADDR(jit, op3_addr);
 					ir_CALL_3(IR_VOID, ir_CONST_FC_FUNC(zend_jit_assign_op_to_typed_ref),
 						reference, arg2, ir_CONST_FC_FUNC(binary_op));
 
diff --git a/ext/opcache/tests/jit/gh24437.phpt b/ext/opcache/tests/jit/gh24437.phpt
new file mode 100644
index 00000000000..35b25e0d4aa
--- /dev/null
+++ b/ext/opcache/tests/jit/gh24437.phpt
@@ -0,0 +1,50 @@
+--TEST--
+GH-24437 (JIT: tracing JIT gives wrong sum for `$a[0] += $i + 1` on an array parameter in a loop)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=tracing
+--FILE--
+<?php
+class C {
+    public int $prop = 10;
+}
+
+function f($a) {
+    for ($i = 0; $i < 3; $i++) {
+        @$a[0] += $i + 1;
+    }
+    return $a[0];
+}
+
+function g(array $a) {
+    for ($i = 0; $i < 3; $i++) {
+        $a[0] += $i + 1;
+    }
+    return $a[0];
+}
+
+function h($a) {
+    for ($i = 0; $i < 3; $i++) {
+        $a[2] %= $i + 1;
+        $x = $a[0] %= 1;
+    }
+}
+
+var_dump(f([1 => 2]));
+$x = 10;
+var_dump(g([&$x]), $x);
+$c = new C;
+var_dump(g([&$c->prop]), $c->prop);
+@h([]);
+?>
+DONE
+--EXPECT--
+int(6)
+int(16)
+int(16)
+int(16)
+int(16)
+DONE