[BUG] `Store` instruction triggers `Load Access Fault (mcause=5)` instead of `Store Fault` upon `PMP` write violation

Placeholder hjw_arch
2026-03-10T13:19:44Z

### Description
During fuzzing, we observed that when store instructions (e.g., `sw`, `fsw`) access a PMP write-protected region, CVA6 incorrectly raises a **Load Access Fault (mcause=5)**. According to the RISC-V Spec, this should be a **Store/AMO Access Fault (mcause=7)**. This behavior is consistent across both integer and floating-point store operations.

### Reproduction Details

- Typical Instruction: sw a2, -580(t6) (PC: 0x80003054)
- Context: Target address is PMP Write-Denied.
- Observation: CVA6 traps the access but reports mcause = 0x5. Spike reports mcause = 0x7.

### Environment

- Commit ID: aa4f5a54
- Config: cv64a6_imafdc_sv39
- ISA: rv64g_zba_zbb_zbs_zbc_zbkb_zbkx_zkne_zknd_zknh

### Potential Root Cause
We suspect a potential issue in the interaction logic between the **LSU (Load-Store Unit)** and the **PMP module**. The behavior suggests that when the PMP trap is triggered, the "Store" attribute of the operation might not be correctly synchronized or propagated, causing the logic to default to a "Load" exception type. This is likely a timing or signaling mismatch.

### Log Comparison

#### Spike
```
core 0: 0x0000000080003048 (0xdacfae23) sw a2, -580(t6)
core 0: exception trap_store_access_fault, epc 0x0000000080003048
core 0: tval 0x0000000080100dbc
core 0: >>>> other_exp
core 0: 0x0000000080001000 (0x34202f73) csrrs t5, mcause, zero
core 0: 3 0x0000000080001000 (0x34202f73) x30 0x0000000000000007
```

#### CVA6
```
LD_ACCESS_FAULT exception @ 0x0000000080003048 (0xdacfae23)
core 0: 0x0000000080001000 (0x34202f73) csrrs t5, mcause, zero
3 0x0000000080001000 (0x34202f73) x30 0x0000000000000005
```

### Related
A similar issue was reported in 2022 as #906 and addressed by #908. On the latest CVA6, we observe a similar symptom. This may indicate a different root cause or a regression. Could you please verify?

### Attachments

ELF binary and full execution logs are attached.

[reproduce_bug_package.zip](https://github.com/user-attachments/files/24424666/reproduce_bug_package.zip)