diff --git a/tests/auto/corelib/text/qbytearray/tst_qbytearray.cpp b/tests/auto/corelib/text/qbytearray/tst_qbytearray.cpp
index 1439fc26a01..7c9d02b9b27 100644
--- a/tests/auto/corelib/text/qbytearray/tst_qbytearray.cpp
+++ b/tests/auto/corelib/text/qbytearray/tst_qbytearray.cpp
@@ -1480,6 +1480,12 @@ void tst_QByteArray::replace_pos_len_data()
     // index out of range
     QTest::newRow("5") << QByteArray() << 3 << 0 << QByteArray("hi")
                        << QByteArray();
+
+    QTest::newRow("negative-before-len-1") << QByteArray("yyyy") << 3 << -1
+                                           << QByteArray("ZZZZ") << QByteArray("yyyZZZZy");
+    QTest::newRow("negative-before-len-2") << QByteArray("yyyy") << 3 << -2
+                                           << QByteArray("ZZZZ") << QByteArray("yyyZZZZy");
+
     // Optimized path
     QTest::newRow("6") << QByteArray("abcdef") << 3 << 12
                        << QByteArray("abcdefghijkl") << QByteArray("abcabcdefghijkl");
diff --git a/tests/auto/corelib/text/qstring/tst_qstring.cpp b/tests/auto/corelib/text/qstring/tst_qstring.cpp
index 383c7cb5218..80f83519571 100644
--- a/tests/auto/corelib/text/qstring/tst_qstring.cpp
+++ b/tests/auto/corelib/text/qstring/tst_qstring.cpp
@@ -1013,6 +1013,14 @@ void tst_QString::replace_pos_len_data()
                            << qsizetype(0) << qsizetype(10) << u"XX"_s
                            << u"XX"_s;
 
+    // TODO: Fix, broken unexpected behavior
+    QTest::newRow("negative-before-len-1") << u"yyyy"_s
+                                           << qsizetype(3) << qsizetype(-1) << u"ZZZZ"_s
+                                           << u"yyyZZZZyy"_s;
+    QTest::newRow("negative-before-len-2") << u"yyyy"_s
+                                           << qsizetype(3) << qsizetype(-2) << u"ZZZZ"_s
+                                           << u"yyyZZZZyyy"_s;
+
     // This is a regression test for an old bug where QString would add index and len parameters,
     // potentially causing integer overflow.
     constexpr qsizetype maxSize = std::numeric_limits<qsizetype>::max();