Interesting.

My instincts were telling me that the solution would be to do a quick check for the flag, hinting to the CPU that it is not expected to be set, and only do the expensive write only if the flag was set. A branch misprediction seems like a small price to pay to exploit this undocumented behaviour.