diff --git a/test/zcrx.c b/test/zcrx.c
index 4f0e6437e..55c4c2bb1 100644
--- a/test/zcrx.c
+++ b/test/zcrx.c
@@ -543,28 +543,49 @@ static int recv_prep(struct io_uring *ring, struct recv_data *rd, int *sock)
 	return 1;
 }
 
-static void refill_garbage(struct recv_data *rd)
+static struct io_uring_zcrx_rqe* get_refill_entry(struct io_uring_zcrx_rq *rq_ring)
 {
+	unsigned mask = rq_ring->ring_entries - 1;
 	struct io_uring_zcrx_rqe* rqe;
-	struct io_uring_zcrx_rq *rq_ring = &rd->rq_ring;
 
-	unsigned mask = rq_ring->ring_entries - 1;
-	rqe = &rq_ring->rqes[(rq_ring->rq_tail & mask)];
-	rqe->off = 512 * 4096;
-	rqe->len = 0;
+	rqe = &rq_ring->rqes[rq_ring->rq_tail & mask];
 	rq_ring->rq_tail++;
+	return rqe;
+}
+
+static void refill_garbage(struct recv_data *rd, uint64_t area_token)
+{
+	struct io_uring_zcrx_rq *rq_ring = &rd->rq_ring;
+	struct io_uring_zcrx_rqe* rqe;
+	int i = 0;
+
+	/* invalid area */
+	rqe = get_refill_entry(rq_ring);
+	rqe->off = (area_token + 1) << IORING_ZCRX_AREA_SHIFT;
+	i++;
+
+	/* invalid area offset */
+	rqe = get_refill_entry(rq_ring);
+	rqe->off = AREA_SZ | (area_token << IORING_ZCRX_AREA_SHIFT);
+	rqe->off += AREA_SZ;
+	i++;
+
+	for (; i < RQ_ENTRIES; i++) {
+		rqe = get_refill_entry(rq_ring);
+		rqe->off = ((uint64_t)1 << IORING_ZCRX_AREA_SHIFT) - 1;
+	}
 
 	io_uring_smp_store_release(rq_ring->ktail, rq_ring->rq_tail);
 }
 
-static int do_recv(struct io_uring *ring, struct recv_data *rd)
+static int do_recv(struct io_uring *ring, struct recv_data *rd,
+		   uint64_t refill_area_token)
 {
 	struct io_uring_cqe *cqe;
 	struct io_uring_zcrx_cqe *zcqe;
 	int i, ret;
 
-	for (i = 0; i < RQ_ENTRIES; i++)
-		refill_garbage(rd);
+	refill_garbage(rd, refill_area_token);
 
 	for (i = 0; i < LOOP_COUNT - 1; i++) {
 		ret = io_uring_wait_cqe(ring, &cqe);
@@ -675,7 +696,7 @@ static void *recv_fn(void *data)
 		fprintf(stderr, "recv_prep failed: %d\n", ret);
 		goto err;
 	}
-	ret = do_recv(&ring, rd);
+	ret = do_recv(&ring, rd, area_reg.rq_area_token);
 
 	close(sock);
 	close(rd->accept_fd);