diff --git a/sim/simx/tcu/tcu_tbuf.cpp b/sim/simx/tcu/tcu_tbuf.cpp
index f362d74d1e..6465e70f4a 100644
--- a/sim/simx/tcu/tcu_tbuf.cpp
+++ b/sim/simx/tcu/tcu_tbuf.cpp
@@ -145,7 +145,10 @@ class TcuTbuf::Impl {
       auto& buf = bufs_.at(s);
       if (buf.pending_q_.empty()) continue;
       uint64_t addr = buf.pending_q_.front();
-      uint32_t sub_tag = buf.next_tag_++;
+      // Mask at generation: pack_tag() masks to kSubTagMask on the wire, so an
+      // unmasked key here stops matching the returned tag once next_tag_ passes
+      // 0xFFFF -- the response is then dropped and the inflight entry never clears.
+      uint32_t sub_tag = (buf.next_tag_++) & kSubTagMask;
       uint32_t tag = pack_tag(s, sub_tag);
       MemReq m(MemOp::LD, addr, /*data*/nullptr, /*byteen*/0, tag, /*hart_id*/0, /*uuid*/0);
       m.flags.local = 1;   // TCU TBUF reads from LMEM