[BUG] Locked non-writable PMP entry fails to trap some store operations in `M-Mode`

Placeholder hjw_arch
2026-01-06T14:34:01Z

### Description
We observed an inconsistency in `PMP` checking within CVA6. In M-Mode, when a PMP entry is configured as Locked and **Non-Writable** (W=0, L=1), it is expected to trap all store instructions targeting the protected region.

However, the core fails to trap some store operations (partial escape). Within a single run, some `sw` / `AMO (RMW)` operations **retire successfully and update memory**, while later stores to the same address may raise `ST_ACCESS_FAULT`. The behavior is inconsistent.

### Steps to Reproduce

- Enter M-Mode.
- Configure a PMP entry (e.g., `pmpaddr7/pmpcfg0`) to cover a specific memory region.
- Set the PMP configuration to **Locked** and **Non-Writable** (e.g., L=1, W=0, R=1).
- Execute a sequence of store instructions targeting the locked region.

Observe that some store instructions commit successfully (write to memory) instead of triggering a Store Access Fault.

### Actual Behavior
The locked PMP entry **fails** to intercept specific store instructions, allowing illegal writes to occur in M-Mode. The failure is not consistent across all stores (partial escape).

### Expected Behavior
All store operations to a Locked, Non-Writable PMP region in M-Mode must trigger a Store Access Fault exception.

### Environment
Commit ID: aa4f5a5
Config: cv64a6_imafdc_sv39
ISA: rv64g_zba_zbb_zbs_zbc_zbkb_zbkx_zkne_zknd_zknh

### Logs
#### spike
```
core 0: 0x0000000080003038 (0x01dfa023) sw t4, 0(t6)
core 0: exception trap_store_access_fault, epc 0x0000000080003038
core 0: tval 0x0000000080101000
core 0: >>>> other_exp
```

#### cva6
```
core 0: 0x0000000080003038 (0x01dfa023) sw t4, 0(t6)
3 0x0000000080003038 (0x01dfa023) mem 0x0000000080101000 0x0000000000000000
core 0: 0x000000008000303c (0xffffef17) auipc t5, 0xffffe
3 0x000000008000303c (0xffffef17) x30 0x000000008000103c
```

### Attachments
ELF binary and full execution logs are attached.

[pmp_bug_in_mmode.zip](https://github.com/user-attachments/files/24449028/pmp_bug_in_mmode.zip)