diff --git a/bin/regression-wally b/bin/regression-wally
index 8bb0cd5fb..75adf9a60 100755
--- a/bin/regression-wally
+++ b/bin/regression-wally
@@ -528,25 +528,18 @@ def selectTests(args, sims, coverStr):
 
     if (args.performance or args.nightly):
         # RUNNING THE EMBENCH TEST
-        actual_embench_directory = f"{WALLY}/benchmarks/embench/actual_embench_results/"
-        expected_embench_directory = f"{WALLY}/benchmarks/embench/expected_embench_results/"
-        embench_logfile_path = os.path.expandvars("$WALLY/benchmarks/embench/run.log")
-        # Create the file if it doesn't exist
-        with open(embench_logfile_path, 'w'):
-            pass
-        
-        # Combine everything into the embench_test command
+        embench_dir = f"{WALLY}/benchmarks/embench/"
+        actual_embench_directory = f"{embench_dir}/actual_embench_results/"
+        expected_embench_directory = f"{embench_dir}/expected_embench_results/"
+        embench_logfile_path = f"{embench_dir}/run.log"
         # finds any differences between the two embench directories and appends them to the log file
         embench_test = TestCase(
             name="embench",
             variant="rv32gc",
-            cmd=(
-                f"cd $WALLY/benchmarks/embench && "
-                f"make run >> {embench_logfile_path} 2>&1"
-            ),
+            cmd=(f"make -C {WALLY}/benchmarks/embench run > {embench_logfile_path}"),
             grepstr=None,
             grepfile=embench_logfile_path,
-            altcommand=f"diff -ru {actual_embench_directory} {expected_embench_directory} >> {embench_logfile_path}"
+            altcommand=f"diff -ru {actual_embench_directory} {expected_embench_directory} > {embench_logfile_path}"
         )
         configs.append(embench_test)
 
diff --git a/testbench/testbench.sv b/testbench/testbench.sv
index 89e6cc273..98e7cab99 100644
--- a/testbench/testbench.sv
+++ b/testbench/testbench.sv
@@ -715,13 +715,16 @@ module testbench;
   // 3. or PC is stuck at 0
 
 
+  logic [P.XLEN-1:0] PCM;
+  // PCM is not valid for configurations without ZICSR or branch predictor
+  flopenr #(P.XLEN) PCMReg(clk, reset, ~dut.core.StallM, dut.core.PCE, PCM);
   always @(posedge clk) begin
     TestComplete <= ((InstrM == 32'h6f) & dut.core.InstrValidM ) |
 		   ((dut.core.lsu.IEUAdrM == ProgramAddrLabelArray["tohost"] & dut.core.lsu.IEUAdrM != 0) & InstrMName == "SW"); // |
     //   (functionName.PCM == 0 & dut.core.ifu.InstrM == 0 & dut.core.InstrValidM & PrevPCZero));
     if (reset) PrevPCZero <= 0;
-    else if (dut.core.InstrValidM) PrevPCZero <= (dut.core.PCM == 0 & dut.core.ifu.InstrM == 0);
-    if (dut.core.PCM == 0 & dut.core.ifu.InstrM == 0 & dut.core.InstrValidM & PrevPCZero) begin
+    else if (dut.core.InstrValidM) PrevPCZero <= (PCM == 0 & dut.core.ifu.InstrM == 0);
+    if (PCM == 0 & dut.core.ifu.InstrM == 0 & dut.core.InstrValidM & PrevPCZero) begin
       $error("Program fetched illegal instruction 0x00000000 from address 0x00000000 twice in a row.  Usually due to fault with no fault handler.");
       $fatal(1);
     end
diff --git a/tests/coverage/tlbmisc.S b/tests/coverage/tlbmisc.S
index 823988b0e..a15b1141b 100644
--- a/tests/coverage/tlbmisc.S
+++ b/tests/coverage/tlbmisc.S
@@ -145,6 +145,13 @@ ConcurrentICacheMissDTLBMiss:
     sw t1, 0(t0)    # write to page
     jalr ra, t0     # jump to page
 
+    sfence.vma
+
+    li t0, 0x18000000000
+    lw t1, 0(t0)    # read from page
+    sw t1, 0(t0)    # write to page
+    jalr ra, t0     # jump to page
+
     # jump to address for TLB miss to trigger HPTW to make access with DisableTranslation = 1, Translate = 0
     li t0, 0x80805000
     jalr ra, t0
@@ -264,6 +271,10 @@ ConcurrentICacheMissDTLBMiss:
     cbo.zero (t0)
     cbo.clean (t0)
 
+    # attempt read from read disabled, execute enabled PTE with MXR set
+    li t0, 0x81600000
+    lw t1, 0(t0)    # read from page
+
     # clear mstatus.MXR
     li a0, 3
     ecall
@@ -344,7 +355,7 @@ pagetable:
     .8byte 0x20004401  # VA 0x00000000-0x7F_FFFFFFFF: PTE at 0x80011000 01 valid
     .8byte 0x00000000000010CF # misaligned terapage at 0x80_00000000
     .8byte 0x00000000000000CF # access fault terapage at 0x100_00000000
-    .8byte 0x4000000020004401 # Bad PBMT at VA 0x180_0000000
+    .8byte 0x4000000020004401 # Bad PBMT at VA 0x180_00000000
 
 # next page table at 0x80011000
 .align 12
@@ -373,7 +384,7 @@ SpecialPage:
     .8byte 0x0000000000004C01  # for VA starting at 81000000 (nonleaf pointing to unimplemented memory causes access fault)
     .8byte 0x4000000020004C01  # for VA starting at 81200000 (nonleaf with PBMT nonzero causes page fault)
     .8byte 0x00000000000000CF  # for VA starting at 81400000 (megapage with access fault)
-    .8byte 0x0000000020004CC1
+    .8byte 0x0000000020004C09  # for VA starting at 81600000 (executable and not readable)
     .8byte 0x0000000020004CC1
     .8byte 0x0000000020004CC1
     .8byte 0x0000000020004CC1