If I'm reading it correctly, the lfence is never reached for real (only speculatively..) code invoking the thunk pushes the target address on the stack, then b

If I'm reading it correctly, the lfence is never reached for real (only speculatively..) code invoking the thunk pushes the target address on the stack, then branches to or calls the thunk. The first instruction of the thunk is a "call" to a nearby address, skipping over an infinite loop (2: lfence; jmp 2b) the lea n(%xsp),%xsp discards the return address pushed by "call", and the subsequent "ret" "returns" to the branch target rather than to label 2. perhaps the speculative execution engine doesn't take the stack pointer adjustment into account and so gets stuck in the lfence loop, only being snapped back to its senses when the lea completes..