So, not to derail the ongoing discussion. But a few things I will mention just as food for thought. [br]
# Any time you're working on a board, especially a liquid damaged one, there is the possibility that in introducing heat, flux or power to the board you're going to add variables. Maybe some corrosion shifted around, or something that was hanging on before, gave up the ghost. If the last component you replaced was the one which seemed to introduce the short, check for other components in that area on the same line.
# A thing to keep in mind with any of the PPBUS rails is that they are all essentially legs of PPBUS_G3H and are generally only separated by a small resistor. You will likely detect short on any of these if one is short. The board I was using for initial practice for board level MacBook repairs was massively liquid damaged. And short on PPBUS_G3H. I ripped off so much stuff trying to hunt it down. It ended up being U7760 (on an 820-00923 board). Which is on PPBUS_HS_OTH3V3.
# The other thing I will mention is, if there is any doubt that this short may be due to CPU mosfets, do some investigating before powering the board in any way (this includes injecting voltage). Especially in cases where there is liquid damage in that area. It is not uncommon for corrosion around those mosfets to bridge PPBUS (~13V) into CPU power (~1V), effectively murdering the CPU.