Architecturally the bounds check holds, but speculatively it doesn't. Train the branch predictor with in-bounds indices, then ask for one past the public prefix and into the flag.
The transient load touches one page from the file-backed probe array at /challenge/probe.