AMD Answer 72824
A speculative address translation (AT) instruction translates using registers associated with an out-of-context translation regime and caches the resulting translation in the L2 TLB. A subsequent translation request generated when the out-of-context translation regime is current uses the previous cached L2 TLB entry, producing an incorrect virtual to physical mapping.
This is a third-party errata (Arm, Inc. 1319367); this issue will not be fixed.