diff --git a/runtime/vm/compiler/stub_code_compiler_arm.cc b/runtime/vm/compiler/stub_code_compiler_arm.cc
index ea76369b54b..39be0b6e1fd 100644
--- a/runtime/vm/compiler/stub_code_compiler_arm.cc
+++ b/runtime/vm/compiler/stub_code_compiler_arm.cc
@@ -1720,7 +1720,7 @@ static void GenerateWriteBarrierStubHelper(Assembler* assembler, bool cards) {
     __ b(&remember_card_slow, EQ);
 
     // Atomically dirty the card.
-    __ PushList((1 << R0) | (1 << R1));
+    __ PushList((1 << R0) | (1 << R1) | (1 << R2));
     __ AndImmediate(TMP, R1, target::kPageMask);  // Page.
     __ sub(R9, R9, Operand(TMP));                 // Offset in page.
     __ Lsr(R9, R9, Operand(target::Page::kBytesPerCardLog2));  // Card index.
@@ -1735,10 +1735,10 @@ static void GenerateWriteBarrierStubHelper(Assembler* assembler, bool cards) {
     __ Bind(&retry);
     __ ldrex(R1, TMP);
     __ orr(R1, R1, Operand(R0));
-    __ strex(R0, R1, TMP);
-    __ cmp(R0, Operand(1));
+    __ strex(R2, R1, TMP);
+    __ cmp(R2, Operand(1));
     __ b(&retry, EQ);
-    __ PopList((1 << R0) | (1 << R1));
+    __ PopList((1 << R0) | (1 << R1) | (1 << R2));
     __ Ret();
 
     // Card table not yet allocated.
diff --git a/runtime/vm/simulator_arm.cc b/runtime/vm/simulator_arm.cc
index 8f901b16e10..5d061726704 100644
--- a/runtime/vm/simulator_arm.cc
+++ b/runtime/vm/simulator_arm.cc
@@ -1049,6 +1049,10 @@ intptr_t Simulator::WriteExclusiveW(uword addr, intptr_t value, Instr* instr) {
   int32_t old_value = static_cast<uint32_t>(exclusive_access_value_);
   ClearExclusive();
 
+  if ((random_.NextUInt32() % 16) == 0) {
+    return 1;  // Spurious failure.
+  }
+
   auto atomic_addr = reinterpret_cast<RelaxedAtomic<int32_t>*>(addr);
   if (atomic_addr->compare_exchange_weak(old_value, value)) {
     return 0;  // Success.
@@ -1508,7 +1512,7 @@ void Simulator::ClobberVolatileRegisters() {
 
   for (intptr_t i = 0; i < kNumberOfCpuRegisters; i++) {
     if ((kAbiVolatileCpuRegs & (1 << i)) != 0) {
-      registers_[i] = icount_;
+      registers_[i] = random_.NextUInt32();
     }
   }
 
diff --git a/runtime/vm/simulator_arm.h b/runtime/vm/simulator_arm.h
index bf149f974e1..9b6fac62364 100644
--- a/runtime/vm/simulator_arm.h
+++ b/runtime/vm/simulator_arm.h
@@ -17,6 +17,7 @@
 #endif
 
 #include "vm/constants.h"
+#include "vm/random.h"
 
 namespace dart {
 
@@ -158,6 +159,7 @@ class Simulator {
   bool pc_modified_;
   uint64_t icount_;
   static int32_t flag_stop_sim_at_;
+  Random random_;
   SimulatorSetjmpBuffer* last_setjmp_buffer_;
 
   // Registered breakpoints.
diff --git a/runtime/vm/simulator_arm64.cc b/runtime/vm/simulator_arm64.cc
index f1473aa3aa1..6324139df06 100644
--- a/runtime/vm/simulator_arm64.cc
+++ b/runtime/vm/simulator_arm64.cc
@@ -1219,6 +1219,10 @@ intptr_t Simulator::WriteExclusiveX(uword addr, intptr_t value, Instr* instr) {
   int64_t old_value = exclusive_access_value_;
   ClearExclusive();
 
+  if ((random_.NextUInt32() % 16) == 0) {
+    return 1;  // Suprious failure.
+  }
+
   auto atomic_addr = reinterpret_cast<RelaxedAtomic<int64_t>*>(addr);
   if (atomic_addr->compare_exchange_weak(old_value, value)) {
     return 0;  // Success.
@@ -1237,6 +1241,10 @@ intptr_t Simulator::WriteExclusiveW(uword addr, intptr_t value, Instr* instr) {
   int32_t old_value = static_cast<uint32_t>(exclusive_access_value_);
   ClearExclusive();
 
+  if ((random_.NextUInt32() % 16) == 0) {
+    return 1;  // Spurious failure.
+  }
+
   auto atomic_addr = reinterpret_cast<RelaxedAtomic<int32_t>*>(addr);
   if (atomic_addr->compare_exchange_weak(old_value, value)) {
     return 0;  // Success.
@@ -1763,7 +1771,7 @@ void Simulator::ClobberVolatileRegisters() {
 
   for (intptr_t i = 0; i < kNumberOfCpuRegisters; i++) {
     if ((kAbiVolatileCpuRegs & (1 << i)) != 0) {
-      registers_[i] = icount_;
+      registers_[i] = random_.NextUInt64();
     }
   }
 
diff --git a/runtime/vm/simulator_arm64.h b/runtime/vm/simulator_arm64.h
index 63a85d66309..2e2fddb8a72 100644
--- a/runtime/vm/simulator_arm64.h
+++ b/runtime/vm/simulator_arm64.h
@@ -17,6 +17,7 @@
 #endif
 
 #include "vm/constants.h"
+#include "vm/random.h"
 
 namespace dart {
 
@@ -142,6 +143,7 @@ class Simulator {
   bool pc_modified_;
   uint64_t icount_;
   static int64_t flag_stop_sim_at_;
+  Random random_;
   SimulatorSetjmpBuffer* last_setjmp_buffer_;
 
   // Registered breakpoints.
diff --git a/runtime/vm/simulator_riscv.cc b/runtime/vm/simulator_riscv.cc
index 48a9fab796a..6005bd0fb83 100644
--- a/runtime/vm/simulator_riscv.cc
+++ b/runtime/vm/simulator_riscv.cc
@@ -2131,6 +2131,10 @@ void Simulator::InterpretSC(Instr instr) {
     set_xreg(instr.rd(), 1);
     return;
   }
+  if ((random_.NextUInt32() % 16) == 0) {  // Spurious failure.
+    set_xreg(instr.rd(), 1);
+    return;
+  }
   type expected = reserved_value_;
   type desired = get_xreg(instr.rs2());
   bool success =
diff --git a/runtime/vm/simulator_riscv.h b/runtime/vm/simulator_riscv.h
index 467a46d2b59..1f9e6f35541 100644
--- a/runtime/vm/simulator_riscv.h
+++ b/runtime/vm/simulator_riscv.h
@@ -19,7 +19,6 @@ class Mutex;
 class SimulatorSetjmpBuffer;
 class Thread;
 
-// TODO(riscv): Introduce random LR/SC failures.
 // TODO(riscv): Dynamic rounding mode and other FSCR state.
 class Simulator {
  public: