diff --git a/verif/env/corev-dv/cva6_illegal_instr.sv b/verif/env/corev-dv/cva6_illegal_instr.sv
index a098a7a2e8..356d9fe6da 100644
--- a/verif/env/corev-dv/cva6_illegal_instr.sv
+++ b/verif/env/corev-dv/cva6_illegal_instr.sv
@@ -61,4 +61,15 @@ class cva6_illegal_instr_c extends riscv_illegal_instr;
     }
   }
 
+  // Invalid SYSTEM instructions
+  constraint system_instr_c {
+    if (exception == kIllegalSystemInstr) {
+      opcode == 7'b1110011;
+      func3 == 3'b000;
+      // ECALL/EBREAK/xRET/WFI
+      // Constrain the upper 12 bits to avoid ecall instruction
+      instr_bin[31:20] != 0;
+    }
+  }
+
 endclass
diff --git a/verif/env/corev-dv/cva6_instr_sequence.sv b/verif/env/corev-dv/cva6_instr_sequence.sv
index 77beaf36f7..f64b882f65 100644
--- a/verif/env/corev-dv/cva6_instr_sequence.sv
+++ b/verif/env/corev-dv/cva6_instr_sequence.sv
@@ -45,7 +45,7 @@ class cva6_instr_sequence_c extends riscv_instr_sequence;
                       bin_instr_cnt, cfg_cva6.unsupported_instr_ratio), UVM_LOW)
       repeat (bin_instr_cnt) begin
         `DV_CHECK_RANDOMIZE_WITH_FATAL(unsupported_instr, 
-                                       unsupported_instr inside {rv64i_instr,rv64c_instr,rv64m_instr,rvfdq_instr};)
+                                       unsupported_instr inside {rv64i_instr,rv64c_instr,rv64m_instr,rvfdq_instr,illegal_slli_srai,sys_instr};)
         str = {indent, $sformatf(".4byte 0x%s # %0s",
                        unsupported_instr.get_bin_str(), unsupported_instr.comment)};
                idx = $urandom_range(0, instr_string_list.size());
diff --git a/verif/env/corev-dv/cva6_unsupported_instr.sv b/verif/env/corev-dv/cva6_unsupported_instr.sv
index 932e1da3c0..5cdd74911f 100644
--- a/verif/env/corev-dv/cva6_unsupported_instr.sv
+++ b/verif/env/corev-dv/cva6_unsupported_instr.sv
@@ -30,7 +30,9 @@ class cva6_unsupported_instr_c extends uvm_object;
     rv64i_instr,
     rv64c_instr,
     rv64m_instr,
-    rvfdq_instr
+    rvfdq_instr,
+    sys_instr,
+    illegal_slli_srai
   } illegal_ext_instr_type_e;
 
   // Default legal opcode for RV32I instructions
@@ -112,10 +114,12 @@ class cva6_unsupported_instr_c extends uvm_object;
 
   constraint exception_dist_c {
     unsupported_instr dist {
-      rv64i_instr := 1,
-      rv64c_instr := 1,
-      rv64m_instr := 1,
-      rvfdq_instr := 1  
+      rv64i_instr := 3,
+      rv64c_instr := 3,
+      rv64m_instr := 3,
+      rvfdq_instr := 3,
+      sys_instr   := 1,
+      illegal_slli_srai := 1
     };
   }
 
@@ -143,6 +147,35 @@ class cva6_unsupported_instr_c extends uvm_object;
     }
   }
 
+  // unsupported system instructions
+  // sfence.vma instruction
+  constraint sys_instr_c {
+    if (unsupported_instr == sys_instr) {
+         compressed == 0;
+         opcode == 7'b1110011;
+         func3 == 3'b000;
+         instr_bin[11:7] inside {5'b0, 5'b00001};
+         func7 == 7'b0001001;
+
+    }
+  }
+
+  // illegal RV32 SLLI & SRAI instruction with 25th bit is high
+  constraint illegal_slli_srai_32_instr_c {
+    if (unsupported_instr == illegal_slli_srai) {
+         compressed == 0;
+         opcode == 7'b0010011;
+         instr_bin[25] != 1'b0;
+         func3 inside {3'b001, 3'b101};
+         if (func3 == 3'b001) {
+            instr_bin[31:26] == 6'b000000;
+         }
+         else if (func3 == 3'b101) {
+            instr_bin[31:26] == 6'b010000;
+         }
+    }
+  }
+
   // RV64I instructions
   constraint rv64i_instr_c {
     if (!RV64I inside {supported_isa}) {
@@ -336,7 +369,7 @@ class cva6_unsupported_instr_c extends uvm_object;
   constraint has_func7_c {
     solve opcode before func7;
     solve func7 before func3;
-    if (opcode == 7'b0111011) {
+    if (opcode inside {7'b0111011, 7'b1110011}) {
       has_func3 == 1'b1;
       has_func7 == 1'b1;
       has_func2 == 1'b0;  
@@ -351,7 +384,7 @@ class cva6_unsupported_instr_c extends uvm_object;
         has_func7 == 1'b1;
       }
     }
-    if (opcode inside {7'b0000111, 7'b0100111}) {
+    if (opcode inside {7'b0000111, 7'b0100111, 7'b0010011}) {
       has_func2 == 1'b0;
       has_func3 == 1'b1;
       has_func7 == 1'b0;
diff --git a/verif/regress/dv-generated-tests.sh b/verif/regress/dv-generated-tests.sh
index ae5bab61df..07e1de7eaa 100644
--- a/verif/regress/dv-generated-tests.sh
+++ b/verif/regress/dv-generated-tests.sh
@@ -62,7 +62,7 @@ elif [[ "$list_num" = 3 ]];then
            "riscv_arithmetic_basic_illegal_hint_test"
            "riscv_arithmetic_basic_ebreak_dret_test"
            );
-   I=(50 50 50);
+   I=(100 100 20);
 elif [[ "$list_num" = 4 ]];then
 	TEST_NAME=(
            "riscv_mmu_stress_hint_test"