diff --git a/src/main/scala/diplomacy/Parameters.scala b/src/main/scala/diplomacy/Parameters.scala
index 4e8ef4c1..cf4c0911 100644
--- a/src/main/scala/diplomacy/Parameters.scala
+++ b/src/main/scala/diplomacy/Parameters.scala
@@ -126,6 +126,9 @@ case class AddressSet(base: BigInt, mask: BigInt) extends Ordered[AddressSet]
   def contains(x: BigInt) = ((x ^ base) & ~mask) == 0
   def contains(x: UInt) = ((x ^ UInt(base)).zext() & SInt(~mask)) === SInt(0)
 
+  // turn x into an address contained in this set
+  def legalize(x: UInt): UInt = base.U | (mask.U & x)
+
   // overlap iff bitwise: both care (~mask0 & ~mask1) => both equal (base0=base1)
   def overlaps(x: AddressSet) = (~(mask | x.mask) & (base ^ x.base)) == 0
   // contains iff bitwise: x.mask => mask && contains(x.base)
diff --git a/src/main/scala/uncore/tilelink2/Fuzzer.scala b/src/main/scala/uncore/tilelink2/Fuzzer.scala
index 1bfa52e0..a55d4d44 100644
--- a/src/main/scala/uncore/tilelink2/Fuzzer.scala
+++ b/src/main/scala/uncore/tilelink2/Fuzzer.scala
@@ -136,8 +136,8 @@ class TLFuzzer(
     val log_op    = noiseMaker(2, inc, 0)
     val amo_size  = UInt(2) + noiseMaker(1, inc, 0) // word or dword
     val size      = noiseMaker(sizeBits, inc, 0)
-    val addrMask  = overrideAddress.map(_.max.U).getOrElse(~UInt(0, addressBits))
-    val addr      = noiseMaker(addressBits, inc, 2) & ~UIntToOH1(size, addressBits) & addrMask
+    val rawAddr   = noiseMaker(addressBits, inc, 2)
+    val addr      = overrideAddress.map(_.legalize(rawAddr)).getOrElse(rawAddr) & ~UIntToOH1(size, addressBits)
     val mask      = noiseMaker(beatBytes, inc_beat, 2) & edge.mask(addr, size)
     val data      = noiseMaker(dataBits, inc_beat, 2)