[caf]

Turns out "maybe" is "not" - if you put the faulting read at a mispredicted branch target, you don't take the fault.