The Linux comment: head.S supports being entered with the MMU either on or off, and the two branches around that comment handle mirror-image hazards:

  - Entered MMU off: it just wrote init_idmap_pg_dir with non-cacheable stores, but clean lines may have been speculatively allocated over those addresses — so it invalidates the
  tables to PoC before the caches come on.
  - Entered MMU on (your quote): the image was written into RAM by the EFI stub through Inner-Shareable Write-Back mappings, and those writes may still be dirty above the PoC.
  init_kernel_el is about to turn the MMU off, and MMU-off reads of that code are mismatched-attribute observers: literal-pool data reads are Device-nGnRnE (straight to DRAM), and
  instruction fetches are OSH-WT vs the ISH-WB writes. Per B2.11, such reads "might not return the value most recently written" — i.e., stale bytes from DRAM. The only point every
  observer is guaranteed to see is the PoC, hence dcache_clean_poc(__idmap_text_start, __idmap_text_end). PoU (dc cvau/ic ivau) is only sufficient when both writer and fetcher are
  Normal-cacheable — which is why it's the right point for our kernel-image maintenance, since Ultra kernels start with MMU+caches on.

  And yes — you caught a real gap

  So the direct answer to your previous question splits in two:

  - Data: no flush needed — the trampoline makes zero data accesses in the MMU-off window (everything preloaded into registers), and afterwards WB→WB attributes match, so dirty lines
  remain valid cached data. That part of my earlier answer stands.
  - The trampoline's own instruction fetches: my "it's WT-cacheable and unmodified, so coherent" claim was wrong in exactly the way Linux's comment addresses. The trampoline's bytes
  were written by EDK2's PE loader via ISH-WB mappings and cleaned only to the PoU — the MMU-off fetch is a mismatched observer with no architectural guarantee of seeing them. Same
  bug class, ~15 instructions wide, invisible on QEMU.

  Fixed: handover_prepare_for() now also cleans [kernel_handover_aarch64, kernel_handover_aarch64_end) to the PoC (dc cvac + dsb sy), with an end label exported from the asm and the
  three maintenance loops deduplicated into a CACHE_OP_RANGE macro. Disassembly verified (dc cvau → dsb ish → ic ivau → dc cvac → dsb sy; isb), all 14 aarch64 tests pass, and the
  change is folded into the rework commit (now bab4df0, message updated to document both the no-data-access invariant and the PoC clean; the other four commits cherry-picked back on
  top unchanged, tree clean).