P117 tried the next frontend move after active predictor steering: keep predicted-target instruction data in a one-entry speculative target buffer, then promote it into the normal fetch queue only if the queued branch resolves to that PC.
The live version was still unsafe. With issue allowed only in userspace,
Linux reached /init, then BusyBox took signal 11 on a store fault at
badaddr=0x00000000. That is a better failure than the earlier
kernel-entry wedge because it says the hazard is now in the speculative
target issue/fill path, not basic Linux boot.
The checked-in RTL leaves the buffer state and counters in place but gates issue off:
steering candidates : 215,013
steering issues : 0
stbuf fills : 0
stbuf promotes : 0
stbuf discards : 0
FTQ fills/consumes : 54,059,898 / 54,059,898
FTQ flushes : 0The guarded shell profile is PASS:
post-load cycles : 218,191,245
shell window cycles : 64,329,783
retired instructions: 86,161,477
CPI : 2.5324
S_FETCH cycles : 7,615,856
S_MEM cycles : 27,670,716Honest status: RTL simulation PASS for the guarded P117 rung. Live speculative target-buffer issue is FAIL. LibreLane hardening is NOT RUN.