The dynamic MUX, in certain instances, can violate RSP-3 and RSP-5 and cause similar violations in downstream modules. The root cause is that the r_ready signal is propagated incorrectly:
https://github.com/pulp-platform/hci/blame/afe0220f9a2f132dc8655c48da05aae5121a570b/rtl/core/hci_core_mux_dynamic.sv#L212
The correct behavior would be to route r_ready similarly to what is done for r_valid.