diff --git a/hdl/hazard3_core.v b/hdl/hazard3_core.v
index 97e90c8..a039e5d 100644
--- a/hdl/hazard3_core.v
+++ b/hdl/hazard3_core.v
@@ -524,7 +524,7 @@ hazard3_csr #(
 	// CSR access port
 	// *en_soon are early access strobes which are not a function of bus stall.
 	// Can generate access faults (hence traps), but do not actually perform access.
-	.addr                       (d_imm[11:0]), // todo could just connect this to the instruction bits
+	.addr                       (fd_cir[31:20]), // Always I-type immediate
 	.wdata                      (x_csr_wdata),
 	.wen_soon                   (d_csr_wen && !m_trap_enter_soon),
 	.wen                        (d_csr_wen && !m_trap_enter_soon && !x_stall),
diff --git a/hdl/hazard3_csr.v b/hdl/hazard3_csr.v
index 326ee92..2d15b89 100644
--- a/hdl/hazard3_csr.v
+++ b/hdl/hazard3_csr.v
@@ -105,8 +105,6 @@ module hazard3_csr #(
 	input  wire                instr_ret
 );
 
-// TODO block CSR access when entering trap?
-
 `include "hazard3_ops.vh"
 
 localparam X0 = {XLEN{1'b0}};
@@ -650,8 +648,8 @@ always @ (*) begin
     // ------------------------------------------------------------------------
 	// Trap-handling CSRs
 
-	// TODO bit of a hack but this is a 32 bit synthesised register with
-	// set/clear/write/read, don't turn it on unless we really have to
+	// This is a 32 bit synthesised register with set/clear/write/read, don't
+	// turn it on unless we really have to
 	MSCRATCH: if (CSR_M_TRAP && CSR_M_MANDATORY) begin
 		decode_match = 1'b1;
 		rdata = mscratch;