Penalty to São Paulo FC should stand. The foul occurred before the attacker played or attempted to play the ball, so under Law 11 the foul (not the offside) is the offence — VAR was wrong to overturn to offside, and the defender's caution should also stand.