These are only present in ECMAScript Function Objects, however in the absence of a constructor method the function object is created as a Built-in Function Object:

b. Let F be CreateBuiltinFunction(defaultConstructor, 0, className, « [[ConstructorKind]], [[SourceText]] », the current Realm Record, constructorParent).

This makes the subsequent assignments invalid:

28. Set F.[[PrivateMethods]] to instancePrivateMethods.
29. Set F.[[Fields]] to instanceFields.

It's probably sufficient to add these two to the additional internal slots list passed to CreateBuiltinFunction.

Additionally, InitializeInstanceElements is being invoked from within the synthesized constructor's abstract closure, passing the active function object:

vi. Perform ? InitializeInstanceElements(result, F).

The AO has its argument typed as "an ECMAScript function object" and performs the same field access, which is problematic for the same reasons.