> You can only influence which branch it takes, you can't force it to jump to an arbitrary place. Assuming you've mitigated spectre v2, right? If you are vuln

> You can only influence which branch it takes, you can't force it to jump to an arbitrary place. Assuming you've mitigated spectre v2, right? If you are vulnerable to v2, I can take any other indirect branch in your program (which may appear after some "y" I can control as an input) and have it speculatively branch from there to this "temp &= ..." code, leaking the value of "y". If you are not vulnerable to spectre v2, then I agree, the paths are much more limited and tied to speculative execution that is related to attacker-controlled values.