The point of PAC is that you can’t create an arbitrary return pointer - it’s not based on ahead of time knowledge of what they fill CFG state is. The return address is signed as a byproduct of making the call in the first place, so to return to a different location you need to be able to rop through a pointer with a forged signature.