Ahhh, that's what I missed. I thought the "speculative execution" people were talking about was executing the tricks on the copied data after the illegal read.

Ahhh, that's what I missed. I thought the "speculative execution" people were talking about was executing the tricks on the copied data after the illegal read. But not only that, the entire illegal operation can be fenced behind a speculative execution with a simple "if" branch. And illegal reads happen in that kind of context all the time because (for example) that's how every FOR loop ends. There's really two places where pipelining and speculative execution are causing this problem - the obvious one where the CPU is allowed to manipulate protected data before everything gets blown away (except cache loads of legal data, hence the problem), but a second one that means that reads of protected data happen all the time in normal branch prediction misses. When it happens in normal flow, you can't punish it by killing the process. Reading protected memory in a speculative branch isn't some digital "attempted breaking an entering" that you can clamp down hard on, it's totally normal behavior. I get it now, thanks.