This branch prediction inside a "gadget" needs to be mapped into the address spaces of both attacker and victim (i.e. shared lib). But even if the attacker can

This branch prediction inside a "gadget" needs to be mapped into the address spaces of both attacker and victim (i.e. shared lib). But even if the attacker can get this code to run on both sides and examine the dependent timings to find out underlying values, the victim code can't be tricked to sequentially read-by-speculation all its internal data. Does the instruction cache get poisoned as well on a mispredict and carried over?