This should error, as combining final and private are a usually illegal combination. It seems the visibility flags aren't correctly initialized at all.

https://3v4l.org/UIrg1#v8.3.0

Method [ <user> final <visibility error> method foo ] {
  @@ /in/UIrg1 5 - 5
}

Yeah, as I'm saying in the original post:

Alternatively, a syntax resulting in "final private" class method should be rejected because normally they're not allowed.

But reflection lies for protected too: https://3v4l.org/0PZvm#v8.3.0

The problem, and similar for the other issue, is that the following code makes an assumption that if any modifier is set it is always the PPP mask:
fn_copy.common.fn_flags = alias->modifiers | (fn->common.fn_flags & ~ZEND_ACC_PPP_MASK);

I think instead something like this is desirable:

if (alias->modifiers & ZEND_ACC_PPP_MASK) {
    fn_copy.common.fn_flags = alias->modifiers | (fn->common.fn_flags & ~ZEND_ACC_PPP_MASK);
} else {
    fn_copy.common.fn_flags = alias->modifiers | fn->common.fn_flags;
}

In this case if a visibility modifier is set we always take those (and other flags) from the modifier.
If it is not set we don't remove the visibility from fn_flags but instead just add the modifiers on top.

To make it error out we additionally need a check like if ((fn->common.fn_flags & ZEND_ACC_PRIVATE) && (fn->common.fn_flags & ZEND_ACC_FINAL)) somewhere.

Hey, there's a new bug in PHP 8.3.2 because of this behaviour: https://3v4l.org/VIEcd

I'm gonna open a new bug report about this, just wanted to inform you.