Speculative execution, variant 4: speculative store bypass
Possibly completely unrelated question (this stuff is firmly over my head): toward the end of the first PoC there's      /* if we don't break the loop after some time when it doesn't
  work, in NO_INTERRUPTS mode with SMP disabled, the machine will lock
  up */

The bit at the top of the that says  ======== Demo code (no privilege boundaries crossed) ========

is suggestive and unambiguous, but the program executions show (with "$"s) that this is being executed as non-root.So... is this deadlock fundamentally related to the speculative execution glitch(es)?