> By reducing all returns in the kernel to a single one, it becomes possible to ensure a safe (but still incorrect) branch predictor state each time this return is executed

I'm way out of my depth here, what does this mean? My naive guess is that they ensure there is a single assembly instruction in the entire kernel that can do a return, and every place that wants to return jumps to that return?