No no no, you can easily train the branch predictor by sending a bunch of valid requests followed by an invalid request with a payload that redirects the ensuing speculative load into your desired address range.
Yes, but to do that, your code needs to use the same branch predictor as the victim code. If the branch prediction buffer is per-core and not shared among multiple cores, then that means you have to run on hte same core as the kernel. If the kernel always runs on a different core, you cannot do anything.