I haven't thought thoroughly about the fix yet. But one way I'm thinking is that in create_subqueryscan_plan() we can first add the subquery's subplan_params to root->curOuterParams, and then replace outer-relation Vars in scan_clauses afterwards. That can make us be able to share the same PARAM_EXEC slot for the same Var that both belongs to the subquery's uplevel vars and to the NestLoop's outer-relation vars. To be concrete, something like attached.
After some more thought, I think this is the right way to fix this issue. The idea here is to make sure that the same NLP Var shares the same PARAM_EXEC slot. This change can also help to save PARAM_EXEC slots (which is trivial though since slots are very cheap).