Virtual Address Translation Process Violation

[mhayat-10xe]

In the Risc-v privileged spec section "Virtual Address Translation Process" in point 4 states that:

4. Otherwise, the PTE is valid. If pte.r = 1 or pte.x = 1, go to step 5. Otherwise, this PTE is a pointer to the next level of the page table. Let i = i − 1. If i < 0, stop and raise a page-fault exception corresponding to the original access type. Otherwise, let a = pte.ppn × PAGESIZE and go to step 2.

I wrote an assertion that states:

If the leaf entry does not come after two pte then trans_error must be asserted and cause_code should be "page fault exception".

Below is the counter-example of the assertion failure, in the 13th cycle, we have a first non-leaf pte, followed by the next non-leaf pte in the 15th cycle. Now in the 17th cycle when we have a 3rd pte it must be leaf pte otherwise there must be an error but here it is not giving any error which is wrong.