I think that there are a few problems in section 5.5.1 of the hypervisor spec. It says that G-stage translation follows the same algorithm as section 4.3.2 with a few changes. However: [... some things are wrong]
It seems the algorithm in section 4.3.2 was edited since section 5.5.1 was written. I'm looking at updating section 5.5.1 to adapt to the changes.