diff --git a/rtl/ibex_cs_registers.sv b/rtl/ibex_cs_registers.sv
index 3e88eff2..0191742b 100644
--- a/rtl/ibex_cs_registers.sv
+++ b/rtl/ibex_cs_registers.sv
@@ -126,17 +126,17 @@ module ibex_cs_registers #(
   // Is a PMP config a locked one that allows M-mode execution when MSECCFG.MML is set (either
   // M mode alone or shared M/U mode execution)?
   function automatic logic is_mml_m_exec_cfg(ibex_pkg::pmp_cfg_t pmp_cfg);
-    logic unused_cfg;
-    unused_cfg = ^{pmp_cfg.mode};
+    logic unused_cfg = ^{pmp_cfg.mode};
+    logic value = 1'b0;
 
     if (pmp_cfg.lock) begin
       unique case ({pmp_cfg.read, pmp_cfg.write, pmp_cfg.exec})
-        3'b001, 3'b010, 3'b011, 3'b101: return 1'b1;
-        default: return 1'b0;
+        3'b001, 3'b010, 3'b011, 3'b101: value = 1'b1;
+        default: value = 1'b0;
       endcase
     end
 
-    return 1'b0;
+    return value;
   endfunction
 
   localparam int unsigned RV32BExtra = (RV32B == RV32BOTEarlGrey) || (RV32B == RV32BFull) ? 1 : 0;
diff --git a/rtl/ibex_pmp.sv b/rtl/ibex_pmp.sv
index a467acf5..74cb6a37 100644
--- a/rtl/ibex_pmp.sv
+++ b/rtl/ibex_pmp.sv
@@ -56,16 +56,13 @@ module ibex_pmp #(
                                               ibex_pkg::pmp_req_e  pmp_req_type,
                                               ibex_pkg::priv_lvl_e priv_mode,
                                               logic                permission_check);
-    if (csr_pmp_mseccfg_mml) begin
-      return mml_perm_check(csr_pmp_cfg,
-                            pmp_req_type,
-                            priv_mode,
-                            permission_check);
-    end else begin
-      return orig_perm_check(csr_pmp_cfg.lock,
-                             priv_mode,
-                             permission_check);
-    end
+    return csr_pmp_mseccfg_mml ? mml_perm_check(csr_pmp_cfg,
+                                                pmp_req_type,
+                                                priv_mode,
+                                                permission_check) :
+                                 orig_perm_check(csr_pmp_cfg.lock,
+                                                 priv_mode,
+                                                 permission_check);
   endfunction
 
   // Compute permissions checks that apply when MSECCFG.MML is set. Added for Smepmp support.
@@ -134,13 +131,14 @@ module ibex_pmp #(
     // modes. Also deny unmatched for M-mode whe MSECCFG.MML is set and request type is EXEC.
     logic access_fail = csr_pmp_mseccfg_mmwp | (priv_mode != PRIV_LVL_M) |
                         (csr_pmp_mseccfg_mml && (pmp_req_type == PMP_ACC_EXEC));
+    logic matched = 1'b0;
 
     // PMP entries are statically prioritized, from 0 to N-1
     // The lowest-numbered PMP entry which matches an address determines accessibility
     for (int r = 0; r < PMPNumRegions; r++) begin
-      if (match_all[r]) begin
+      if (!matched && match_all[r]) begin
         access_fail = ~final_perm_check[r];
-        break;
+        matched = 1'b1;
       end
     end
     return access_fail;