[Sv39] Misaligned superpage (nonzero low PPN) does not raise a page fault

[kkapapu]

Describe the bug

With Sv39 enabled, VPN2=0 of the root page table is a 1 GiB leaf PTE whose PPN[0] is nonzero (misaligned superpage). A ld from VA 0 retires on NutShell with no trap.

# PTE = V|R|A|D | PPN[0]=1  => 0x4C3
sd t1, 0(t0)     # root PTE, 1 GiB leaf, misaligned
csrw satp, ...   # MODE=Sv39
csrs mstatus, MPRV|MPP=S
ld s0, 0(a0)     # a0=0; must page-fault

Expected behavior

RISC-V Privileged Spec, virtual-address translation (step 6):

If i > 0 and pte.ppn[i − 1 : 0] ≠ 0, this is a misaligned superpage; stop and raise a page-fault exception corresponding to the original access type.

Expected: trap (page-fault mcause=13; Sail reports load access-fault mcause=5 on this PoC)
Actual: mcause=0, the ld retires
The PTW in TLB.scala / EmbeddedTLB.scala refills from a leaf at level===3/2 without checking that pte.ppn[i-1:0] is zero.