Now we are doing both bounds check branches and index masking. The index masking is purely additive. We didn't replace branches.

Similarly, where we use pointer poisoning, it is in addition to some other security check, which is almost always a branch.