diff --git a/components/esp_hw_support/port/esp32c61/cpu_region_protect.c b/components/esp_hw_support/port/esp32c61/cpu_region_protect.c
index 080a56a24fb..846914b6458 100644
--- a/components/esp_hw_support/port/esp32c61/cpu_region_protect.c
+++ b/components/esp_hw_support/port/esp32c61/cpu_region_protect.c
@@ -137,7 +137,7 @@ void esp_cpu_configure_region_protection(void)
     if ((drom_start & (SOC_CPU_PMP_REGION_GRANULARITY - 1)) == 0) {
         PMP_ENTRY_SET(1, SOC_IROM_MASK_LOW, NONE);
         PMP_ENTRY_SET(2, drom_start, PMP_TOR | RX);
-        PMP_ENTRY_SET(3, SOC_DROM_MASK_HIGH, PMP_TOR | RW);
+        PMP_ENTRY_SET(3, SOC_DROM_MASK_HIGH, PMP_TOR | R);
     } else {
         const uint32_t pmpaddr1 = PMPADDR_NAPOT(SOC_IROM_MASK_LOW, SOC_IROM_MASK_HIGH);
         PMP_ENTRY_SET(1, pmpaddr1, PMP_NAPOT | RX);
diff --git a/tools/test_apps/system/panic/main/include/test_memprot.h b/tools/test_apps/system/panic/main/include/test_memprot.h
index 5dde7fc83c5..c24c7ab95d9 100644
--- a/tools/test_apps/system/panic/main/include/test_memprot.h
+++ b/tools/test_apps/system/panic/main/include/test_memprot.h
@@ -48,6 +48,12 @@ void test_spiram_xip_irom_alignment_reg_execute_violation(void);
 
 void test_spiram_xip_drom_alignment_reg_execute_violation(void);
 
+void test_irom_mask_reg_write_violation(void);
+
+#ifdef SOC_DROM_MASK_HIGH
+void test_drom_mask_reg_write_violation(void);
+#endif
+
 void test_drom_reg_write_violation(void);
 
 void test_drom_reg_execute_violation(void);
diff --git a/tools/test_apps/system/panic/main/test_app_main.c b/tools/test_apps/system/panic/main/test_app_main.c
index 76bede0157d..c1996a6ec34 100644
--- a/tools/test_apps/system/panic/main/test_app_main.c
+++ b/tools/test_apps/system/panic/main/test_app_main.c
@@ -174,6 +174,10 @@ void app_main(void)
 
 #if CONFIG_ESP_SYSTEM_PMP_IDRAM_SPLIT
     HANDLE_TEST(test_name, test_irom_reg_write_violation);
+    HANDLE_TEST(test_name, test_irom_mask_reg_write_violation);
+#ifdef SOC_DROM_MASK_HIGH
+    HANDLE_TEST(test_name, test_drom_mask_reg_write_violation);
+#endif
     HANDLE_TEST(test_name, test_drom_reg_write_violation);
     HANDLE_TEST(test_name, test_drom_reg_execute_violation);
 #if CONFIG_SPIRAM_FETCH_INSTRUCTIONS && SOC_MMU_DI_VADDR_SHARED
diff --git a/tools/test_apps/system/panic/main/test_memprot.c b/tools/test_apps/system/panic/main/test_memprot.c
index 46116949cb7..b90ec0c756c 100644
--- a/tools/test_apps/system/panic/main/test_memprot.c
+++ b/tools/test_apps/system/panic/main/test_memprot.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -234,6 +234,23 @@ void test_irom_reg_write_violation(void)
     *test_addr = RND_VAL;
 }
 
+void test_irom_mask_reg_write_violation(void)
+{
+    uint32_t *test_addr = (uint32_t *)(SOC_IROM_MASK_LOW + 0x04);
+    printf("ROM (IROM Mask): Write operation | Address: %p\n", test_addr);
+    *test_addr = RND_VAL;
+}
+
+#ifdef SOC_DROM_MASK_HIGH
+void test_drom_mask_reg_write_violation(void)
+{
+    uint32_t *test_addr = (uint32_t *)(SOC_DROM_MASK_HIGH - 0x04);
+    printf("ROM (DROM Mask): Write operation | Address: %p\n", test_addr);
+    *test_addr = RND_VAL;
+}
+
+#endif
+
 void test_drom_reg_write_violation(void)
 {
     uint32_t *test_addr = (uint32_t *)((uint32_t)(foo_buf));
diff --git a/tools/test_apps/system/panic/pytest_panic.py b/tools/test_apps/system/panic/pytest_panic.py
index 9ea882babd2..2ff254981a9 100644
--- a/tools/test_apps/system/panic/pytest_panic.py
+++ b/tools/test_apps/system/panic/pytest_panic.py
@@ -2149,6 +2149,52 @@ def test_irom_reg_write_violation(dut: PanicTestDut, test_func_name: str) -> Non
     dut.expect_cpu_reset()
 
 
+def irom_mask_reg_write_violation(dut: PanicTestDut, test_func_name: str) -> None:
+    dut.run_test_func(test_func_name)
+    dut.expect_gme('Store access fault')
+    dut.expect_reg_dump(0)
+    dut.expect_cpu_reset()
+
+
+@pytest.mark.generic
+@idf_parametrize(
+    'config,target',
+    [
+        ('memprot_esp32c5', 'esp32c5'),
+        ('memprot_esp32c6', 'esp32c6'),
+        ('memprot_esp32c61', 'esp32c61'),
+        ('memprot_esp32h2', 'esp32h2'),
+        ('memprot_esp32p4', 'esp32p4'),
+    ],
+    indirect=['config', 'target'],
+)
+def test_irom_mask_reg_write_violation(dut: PanicTestDut, test_func_name: str) -> None:
+    irom_mask_reg_write_violation(dut, test_func_name)
+
+
+def drom_mask_reg_write_violation(dut: PanicTestDut, test_func_name: str) -> None:
+    dut.run_test_func(test_func_name)
+    dut.expect_gme('Store access fault')
+    dut.expect_reg_dump(0)
+    dut.expect_cpu_reset()
+
+
+@pytest.mark.generic
+@idf_parametrize(
+    'config,target',
+    [
+        ('memprot_esp32c5', 'esp32c5'),
+        ('memprot_esp32c6', 'esp32c6'),
+        ('memprot_esp32c61', 'esp32c61'),
+        ('memprot_esp32h2', 'esp32h2'),
+        ('memprot_esp32p4', 'esp32p4'),
+    ],
+    indirect=['config', 'target'],
+)
+def test_drom_mask_reg_write_violation(dut: PanicTestDut, test_func_name: str) -> None:
+    drom_mask_reg_write_violation(dut, test_func_name)
+
+
 @pytest.mark.generic
 @idf_parametrize(
     'config,target',