In particular this is a timing attack like Spectre/Meltdown - looks like there are timing issues with allocation of write port slots when writing to the register file - because division takes so long it's possible to use a late write from division to tell whether a particular speculative branch has been taken or not