But we try to understand your fault scenario: How can the LOAD leak
into the critical section? As far as we understand the spin_unlock()
function also contains a memory barrier to prevent such a reordering
from happening.

It does - it would be very interesting for someone to look at the assembly
if this is making a difference.

Alan