sqlsmith: ERROR: XX000: bogus varno: 2

I reduced the problematic query to this.

SELECT 1 FROM pg_rewrite WHERE
pg_get_function_arg_default(ev_class, 1) !~~
pg_get_expr(ev_qual, ev_class, false);

#0 pg_re_throw () at elog.c:1800
#1 0x0000563f5d027932 in errfinish () at elog.c:593
#2 0x0000563f5cb874ee in resolve_special_varno (node=0x563f5dd0f7e0, context=0x7ffcf0daf250, callback=0x563f5cfca270 <get_special_variable>, callback_arg=0x0) at ruleutils.c:7319
#3 0x0000563f5cfca044 in get_variable () at ruleutils.c:7086
#4 0x0000563f5cfc7c58 in get_rule_expr () at ruleutils.c:8363
#5 0x0000563f5cfc97a6 in get_oper_expr (context=0x7ffcf0daf250, expr=0x563f5dd0f6f0) at ruleutils.c:9626
#6 get_rule_expr () at ruleutils.c:8472
#7 0x0000563f5cfcdc37 in deparse_expression_pretty (expr=expr(at)entry=0x563f5dd0f6f0, dpcontext=0x563f5dd10488, forceprefix=forceprefix(at)entry=false, showimplicit=showimplicit(at)entry=false,
prettyFlags=prettyFlags(at)entry=2, startIndent=0) at ruleutils.c:3558
#8 0x0000563f5cfce661 in pg_get_expr_worker (expr=<optimized out>, relid=12104, relname=0x563f5dd10130 "pg_settings", prettyFlags=2) at ruleutils.c:2645
#9 0x0000563f5cd6540b in ExecInterpExpr () at execExprInterp.c:1272
#10 0x0000563f5cd73c5f in ExecEvalExprSwitchContext (isNull=0x7ffcf0daf3a7, econtext=0x563f5dd08a00, state=0x563f5dd0a270) at ../../../src/include/executor/executor.h:339
#11 ExecQual (econtext=0x563f5dd08a00, state=0x563f5dd0a270) at ../../../src/include/executor/executor.h:408
#12 ExecScan (node=0x563f5dd09328, accessMtd=0x563f5cd9e790 <SeqNext>, recheckMtd=0x563f5cd9e780 <SeqRecheck>) at execScan.c:227
#13 0x0000563f5cd69f73 in ExecProcNode (node=0x563f5dd09328) at ../../../src/include/executor/executor.h:257
#14 ExecutePlan (execute_once=<optimized out>, dest=0x563f5dd18a80, direction=<optimized out>, numberTuples=0, sendTuples=<optimized out>, operation=CMD_SELECT,
use_parallel_mode=<optimized out>, planstate=0x563f5dd09328, estate=0x563f5dd08790) at execMain.c:1600
#15 standard_ExecutorRun () at execMain.c:410
#16 0x0000563f5cf0460f in PortalRunSelect () at pquery.c:924
#17 0x0000563f5cf05bf1 in PortalRun () at pquery.c:768
#18 0x0000563f5cf019b2 in exec_simple_query () at postgres.c:1215
#19 0x0000563f5cf0370a in PostgresMain () at postgres.c:4498
#20 0x0000563f5ce6e479 in BackendRun (port=<optimized out>, port=<optimized out>) at postmaster.c:4594
#21 BackendStartup (port=<optimized out>) at postmaster.c:4322
#22 ServerLoop () at postmaster.c:1802
#23 0x0000563f5ce6f47c in PostmasterMain () at postmaster.c:1474
#24 0x0000563f5cb9a0c0 in main (argc=5, argv=0x563f5dc653f0) at main.c:198

While reducing the query, I got a related error:

SELECT 1 FROM pg_rewrite WHERE
pg_get_function_arg_default(ev_class, 1) !~~
pg_get_expr(ev_qual, 0, false);

ERROR: XX000: bogus varlevelsup: 0 offset 0
LOCATION: get_variable, ruleutils.c:7003

Both errors are reproducible back to at least v10.