This should be the required architectural behavior: "a CSR access is
performed after the execution of any prior instructions in program order
whose behavior modifies or is modified by the CSR state and before the
execution of any subsequent instructions in program order whose behavior
modifies or is modified by the CSR state" (Zicsr spec, paragraph "CSR Access
Ordering", available at
https://www.five-embeddev.com/riscv-isa-manual/latest/csr.html#csrinsts).
I think that's necessary, but not sufficient.
IIUC that wording means that writes to the CSR state occur in program order
without requiring additional barriers to take effect. The current value of the
CSR determines whether interrupts *can* be taken, but that doesn't say that
pending interrrupts *must* be taken immediately when unmasked in the CSR.