We frequently miss addressing mode opportunities in the JIT. Some examples I know of off-hand:

• JIT doesn't properly optimize assignment to stackalloced span elements when used as 'out' parameters #38628 (comment)
• peephole optimization for lea command #67187
• JIT: Add a disabled-by-default implementation of strength reduction #104243 (comment) (the example)
• Use GetArrayDataReference in Vector* #104532 (comment)
• Avoid Unsafe.As in BitConverter #112616 (comment)

Frequently the problem seems like a simple one: we end up with an intervening single-def single-used LCL_VAR that we could get rid of by some form of forward substitution.

We could also consider a more advanced address mode formation pass that utilizes SSA or VN during the opts phases.