Note that this includes your explanation with the check_function() - that is not part of the exploit. The branches in their assembly are only about dealing with

Note that this includes your explanation with the check_function() - that is not part of the exploit. The branches in their assembly are only about dealing with the zeros. And, to reiterate: any explanation of Meltdown that depends on branches is incorrect. It's not enough to just use the phrase "out-of-order". All of your examples with if-statements need to change.