diff --git a/tftf/tests/runtime_services/secure_service/test_ffa_indirect_messaging.c b/tftf/tests/runtime_services/secure_service/test_ffa_indirect_messaging.c
index 35c8301..5a60a21 100644
--- a/tftf/tests/runtime_services/secure_service/test_ffa_indirect_messaging.c
+++ b/tftf/tests/runtime_services/secure_service/test_ffa_indirect_messaging.c
@@ -232,3 +232,80 @@
 
 	return TEST_RESULT_SUCCESS;
 }
+
+/**
+ * Test message sent from VM to SP, when VM TX is in realm PAS, the operation
+ * fails smoothly.
+ */
+test_result_t test_ffa_indirect_message_vm_to_sp_tx_realm_fail(void)
+{
+	struct ffa_value ret;
+	struct mailbox_buffers mb;
+	const ffa_id_t vm_id = 1;
+	const ffa_id_t receiver = SP_ID(1);
+	u_register_t ret_rmm;
+	char payload[] = "Poisonous...";
+	struct ffa_partition_msg *message = (struct ffa_partition_msg *)vm1_tx_buffer;
+
+	if (get_armv9_2_feat_rme_support() == 0U) {
+		return TEST_RESULT_SKIPPED;
+	}
+
+	/**********************************************************************
+	 * Check SPMC has ffa_version and expected FF-A endpoints are deployed.
+	 **********************************************************************/
+	CHECK_SPMC_TESTING_SETUP(1, 2, expected_sp_uuids);
+
+	GET_TFTF_MAILBOX(mb);
+
+	/* Map RXTX buffers into SPMC translation. */
+	ret = ffa_rxtx_map_forward(mb.send, vm_id, vm1_rx_buffer,
+				   vm1_tx_buffer);
+
+	if (!is_expected_ffa_return(ret, FFA_SUCCESS_SMC32)) {
+		ERROR("Failed to map buffers RX %p TX %p for VM %x\n",
+		      vm1_rx_buffer, vm1_tx_buffer, vm_id);
+		return TEST_RESULT_FAIL;
+	}
+
+	/* Initialize message header. */
+	ffa_rxtx_header_init(vm_id, receiver, ARRAY_SIZE(payload), &message->header);
+
+	/* Fill TX buffer with payload. */
+	memcpy(message->payload, payload, ARRAY_SIZE(payload));
+
+	/* Delegate TX buffer of VM to realm PAS. */
+	ret_rmm = host_rmi_granule_delegate((u_register_t)vm1_tx_buffer);
+
+	if (ret_rmm != 0UL) {
+		INFO("Delegate operation returns %#lx for address %p\n",
+		     ret_rmm, mb.send);
+		return TEST_RESULT_FAIL;
+	}
+
+	/* Expect that attempting to send message shall fail. */
+	ret = ffa_msg_send2_with_id(0, vm_id);
+
+	if (!is_expected_ffa_error(ret, FFA_ERROR_ABORTED)) {
+		return TEST_RESULT_FAIL;
+	}
+
+	/* Undelegate to reestablish the same security state for PAS. */
+	ret_rmm = host_rmi_granule_undelegate((u_register_t)vm1_tx_buffer);
+
+	if (ret_rmm != 0UL) {
+		INFO("Undelegate operation returns %#lx for address %p\n",
+		     ret_rmm, mb.send);
+		return TEST_RESULT_FAIL;
+	}
+
+	/* Unmap RXTX buffers into SPMC translation. */
+	ret = ffa_rxtx_unmap_with_id(vm_id);
+
+	if (!is_expected_ffa_return(ret, FFA_SUCCESS_SMC32)) {
+		ERROR("Failed to unmap RXTX for vm %x\n", vm_id);
+		return TEST_RESULT_FAIL;
+	}
+
+	return TEST_RESULT_SUCCESS;
+}
diff --git a/tftf/tests/tests-memory-access.xml b/tftf/tests/tests-memory-access.xml
index 360e07f..f1d96e2 100644
--- a/tftf/tests/tests-memory-access.xml
+++ b/tftf/tests/tests-memory-access.xml
@@ -67,6 +67,8 @@
                 function="test_ffa_rxtx_to_realm_pas" />
       <testcase name="FF-A Indirect message fails if VM RX is realm"
                 function="test_ffa_indirect_message_sp_to_vm_rx_realm_fail" />
+      <testcase name="FF-A Indirect message fails if VM TX is realm"
+                function="test_ffa_indirect_message_vm_to_sp_tx_realm_fail" />
   </testsuite>
 
 </testsuites>