One illustrative failure: under a platform contract that requires a hardware-coherent DMA path, a bridge forces transactions outside the required shareability/coherency domain. A DMA read can then observe memory while a newer CPU value remains dirty in a cache.
Second pattern: firmware writes a 32-bit register through a 64-bit path. A correct conversion preserves the access size and valid byte lanes. In this illustrative bug, the bridge wrongly asserts all downstream byte strobes, so the adjacent register is overwritten. The upstream transfer can be legal while the conversion violates the peripheral contract.
Third pattern: two masters use overlapping ID values after a merge bridge that fails to retain the source port. Under concurrent traffic, a response can be returned to the wrong master. A directed concurrent test with identical upstream IDs is the shortest useful reproducer.
Maintain one address map + attribute map shared by RTL, firmware, DV.
Document ID remap tables at every bridge — treat as legal contracts.
System tests must use production firmware init, not backdoor config.
Block-level protocol VIP is necessary but insufficient. Add chip-level checks: attribute passthrough tests per bridge, ID space collision tests, and reduced sequences that cross bridge boundaries.
Scoreboard keys at chip level must include upstream port ID, not just transaction ID. A response with id=3 on port A is not the same as id=3 on port B.
Per bridge: directed test for each attribute bit (pass/drop/transform).
Per bridge: ID remap exhaust for max outstanding depth.
Chip: concurrent multi-master traffic with unique scoreboard keys.
Chip: firmware boot path replay with passive VIP on external ports.