diff --git a/includes/zlib/zdeflate.vp b/includes/zlib/zdeflate.vp
index e79efda..f6f4a0b 100644
--- a/includes/zlib/zdeflate.vp
+++ b/includes/zlib/zdeflate.vp
@@ -329,7 +329,9 @@ def zdeflate_count_cl_freqs(all_lengths: INTPTR, total: t.CInt, cl_freqs: INTPTR
                 if count > 6: count = 6
                 cl_freqs[16] += 1
                 run -= count
-            i += run
+                i += count
+            # 剩余的 1~2 个相同长度值不静默跳过，交由外层循环
+            # 按字面量（符号 val）逐个统计，保证总覆盖数恰为 total
 
 def zdeflate_write_cl_encoded(all_lengths: INTPTR, total: t.CInt,
                                     w: zdef.zbit_writer | t.CPtr, cl_tree: zhuff.zhuff_tree | t.CPtr):
@@ -367,7 +369,9 @@ def zdeflate_write_cl_encoded(all_lengths: INTPTR, total: t.CInt,
                 cl_tree.encode_symbol(16, w)
                 w.write_bits(count - 3, 2)
                 run -= count
-            i += run
+                i += count
+            # 剩余的 1~2 个相同长度值不静默跳过，交由外层循环
+            # 按字面量（符号 val）逐个编码，保证 RLE 覆盖总数恰为 total
 
 
 
diff --git a/includes/zlib/zinflate.vp b/includes/zlib/zinflate.vp
index 18cc5b4..4eabcd5 100644
--- a/includes/zlib/zinflate.vp
+++ b/includes/zlib/zinflate.vp
@@ -70,7 +70,8 @@ class zinflate_stream:
             self.is_gzip = 1
             if self.input_pos + 10 > self.input_len: return -3
             self.input_pos += 10
-            flg: BYTE = self.input_data[self.input_pos - 6]
+            # FLG 位于 gzip 头第 4 字节（偏移 3），即 self.input_pos - 7
+            flg: BYTE = self.input_data[self.input_pos - 7]
             if flg & 0x04:
                 if self.input_pos + 2 > self.input_len: return -3
                 xlen: UINT = self.input_data[self.input_pos] | (self.input_data[self.input_pos + 1] << 8)