> To solve [forward branches], those bytecodes would push information about how the branch destination address shall be fixed up into a late-patch buffer.

This reminds me of how Forth `if` and `then` can be compiled in a single pass -- `if` writes the branch instruction and pushes the current instruction pointer to the stack, and `then` pops it and patches the instruction to point to the current instruction pointer.