diff --git a/dv/uvm/riscv_dv_extension/testlist.yaml b/dv/uvm/riscv_dv_extension/testlist.yaml
index 1d5f9781..ef3f19ad 100644
--- a/dv/uvm/riscv_dv_extension/testlist.yaml
+++ b/dv/uvm/riscv_dv_extension/testlist.yaml
@@ -82,6 +82,7 @@
     +directed_instr_0=riscv_load_store_rand_instr_stream,40
     +directed_instr_1=riscv_load_store_hazard_instr_stream,40
     +directed_instr_2=riscv_multi_page_load_store_instr_stream,40
+    +directed_instr_3=riscv_load_store_rand_addr_instr_stream,40
   rtl_test: core_ibex_base_test
 
 - test: riscv_illegal_instr_test
@@ -279,6 +280,7 @@
     +require_signature_addr=1
     +gen_debug_section=1
     +randomize_csr=1
+    +enable_dummy_csr_write=1
     +boot_mode=m
   rtl_test: core_ibex_debug_csr_test
   sim_opts: >
@@ -331,6 +333,7 @@
     +require_signature_addr=1
     +enable_interrupt=1
     +randomize_csr=1
+    +enable_dummy_csr_write=1
     +boot_mode=m
   rtl_test: core_ibex_irq_csr_test
   sim_opts: >
@@ -471,6 +474,25 @@
     +num_of_sub_program=0
     +boot_mode=u
   rtl_test: core_ibex_umode_tw_test
+  sim_ops: >
+    +require_signature_addr=1
   compare_opts:
     compare_final_value_only: 1
     verbose: 1
+
+# TODO: Only enable U-mode booting for right now, as OVPsim doesn't support some debug CSRs
+- test: riscv_invalid_csr_test
+  desc: >
+    Boot core into random priv mode and generate csr accesses to invalid CSRs (at a higher priv mode)
+  iterations: 10
+  gen_test: riscv_rand_instr_test
+  gen_opts: >
+    +require_signature_addr=1
+    +instr_cnt=6000
+    +num_of_sub_program=0
+    +no_csr_instr=0
+    +enable_access_invalid_csr_level=1
+    +boot_mode=u
+  rtl_test: core_ibex_invalid_csr_test
+  sim_opts: >
+    +require_signature_addr=1
diff --git a/dv/uvm/tests/core_ibex_test_lib.sv b/dv/uvm/tests/core_ibex_test_lib.sv
index 6bc312f9..031f64af 100644
--- a/dv/uvm/tests/core_ibex_test_lib.sv
+++ b/dv/uvm/tests/core_ibex_test_lib.sv
@@ -389,6 +389,17 @@ class core_ibex_directed_test extends core_ibex_debug_intr_basic_test;
   // Checker functions/tasks that might be commonly used
   //------------------------------------------------------
 
+  // Illegal instruction checker
+  virtual task check_illegal_insn(string exception_msg);
+    check_next_core_status(HANDLING_EXCEPTION, "Core did not jump to vectored exception handler", 1000);
+    check_priv_mode(PRIV_LVL_M);
+    check_next_core_status(ILLEGAL_INSTR_EXCEPTION, exception_msg, 500);
+    check_mcause(1'b0, EXC_CAUSE_ILLEGAL_INSN);
+    wait (dut_vif.mret === 1'b1);
+    clk_vif.wait_clks(5);
+    check_priv_mode(operating_mode);
+  endtask
+
   // compares dcsr.ebreak against the privilege mode encoded in dcsr.prv
   virtual function check_dcsr_ebreak();
     // dcsr.prv is the bottom two bits.
@@ -530,15 +541,7 @@ class core_ibex_dret_test extends core_ibex_directed_test;
   virtual task check_stimulus();
     forever begin
       wait (dut_vif.dret === 1'b1);
-      // After hitting a dret, the core will jump to the vectored trap handler, which sends a
-      // handshake write to the bench
-      check_next_core_status(HANDLING_EXCEPTION, "Core did not jump to vectored exception handler",
-                             1000);
-      // The core will receive an illegal instruction handshake after jumping from the vectored trap
-      // handler to the illegal instruction exception handler
-      check_next_core_status(ILLEGAL_INSTR_EXCEPTION,
-                             "Core did not treat dret like illegal instruction", 500);
-      check_mcause(1'b0, EXC_CAUSE_ILLEGAL_INSN);
+      check_illegal_insn("Core did not treat dret like illegal instruction");
     end
   endtask
 
@@ -781,12 +784,24 @@ class core_ibex_umode_tw_test extends core_ibex_directed_test;
     bit [ibex_mem_intf_agent_pkg::DATA_WIDTH-1:0] mcause;
     forever begin
       wait (dut_vif.wfi === 1'b1);
-      check_next_core_status(HANDLING_EXCEPTION, "Core not jump to exception handler on WFI", 500);
-      check_priv_mode(PRIV_LVL_M);
-      check_next_core_status(ILLEGAL_INSTR_EXCEPTION, "Core did not treat U-mode WFI as illegal",
-                             500);
-      check_mcause(1'b0, EXC_CAUSE_ILLEGAL_INSN);
-      wait (dut_vif.mret === 1'b1);
+      check_illegal_insn("Core did not treat U-mode WFI as illegal");
+    end
+  endtask
+
+endclass
+
+// Priv-mode CSR access test
+class core_ibex_invalid_csr_test extends core_ibex_directed_test;
+
+  `uvm_component_utils(core_ibex_invalid_csr_test)
+  `uvm_component_new
+
+  virtual task check_stimulus();
+    forever begin
+      // Wait for a CSR access
+      wait (csr_vif.csr_access == 1'b1);
+      check_illegal_insn($sformatf("Core did not treat access to CSR 0x%0x from %0s as illegal",
+                                   csr_vif.csr_addr, operating_mode));
     end
   endtask