Processor register file visible to software. Rolls back immediately when the branch resolution hardware confirms misprediction.
Hardware execution artifacts (L1/L2 Cache, TLB, Branch Predictor buffers). Never reverted upon misprediction rollback!
In modern speculative execution CPUs (such as Intel Core/Xeon and AMD Zen architectures), branch predictors anticipate control flow decisions to eliminate memory pipeline bubbles. When a branch instruction depends on an uncached boundary check, the processor continues executing subsequent instructions speculatively in the transient execution window.
Although the architectural state (general-purpose registers like R1, R2, R3) is cleanly squashed and rolled back when the misprediction is resolved, the microarchitectural state (the CPU cache hierarchy) is not rolled back because flushing cache lines on every squash would introduce crippling performance penalties. By timing how long memory loads take across an attacker-controlled probe array using high-resolution hardware timers (rdtsc), the attacker recovers sensitive data byte-by-byte.