Obviously some of those are intentional architectural deviations, but is there a good reason to believe the stuck HCR_EL2.E2H bit isn't just an errata?