Proposed resolution (approved by CWG 2025-11-04):

Change in 11.8.5 [class.protected] as follows:

An additional access check beyond those described earlier in 11.8 [class.access] is applied when a non-static data member or non-static member function is a protected member of its designating class (11.8.3 [class.access.base]) and is not designated by a splice-expression. [ Footnote: ... ] As described earlier, access to a protected member is granted because the reference occurs in a friend or direct member of some class C. If the access is to form a pointer to member (7.6.2.2 [expr.unary.op]), the nested-name-specifier shall denote designate C or a class derived from C. All other accesses involve Otherwise, if the access involves a (possibly implicit) object expression (7.5.5.1 [expr.prim.id.general], 7.6.1.5 [expr.ref]). In this case, the class of the object expression shall be C or a class derived from C.

(From submission #784.)

Subclause 11.8.5 [class.protected] establishes an "additional rule" for access to protected non-static members. That rule should be disabled for members designated by a splice-expression.