That wouldn't be enough, either. Core A and V are cache-coherant. Attacker sets up the cache in core A such that its state will be affected based on the victi

That wouldn't be enough, either. Core A and V are cache-coherant. Attacker sets up the cache in core A such that its state will be affected based on the victim's speculation on core V. A speculative write on V to a line that is present in A produces a state change that is visible to A. There's no way you're going to see speculation rollback across cores.