diff --git a/lib/core/Handles/HandlesExprCall.py b/lib/core/Handles/HandlesExprCall.py
index 9883e58..69e510d 100644
--- a/lib/core/Handles/HandlesExprCall.py
+++ b/lib/core/Handles/HandlesExprCall.py
@@ -3654,6 +3654,13 @@ class ExprCallHandle(BaseHandle):
                     ctype_inst = ctype_cls()
                     size_bits = getattr(ctype_inst, 'Size', 0) or 0
                     size_bytes = size_bits // 8
+                    # POINTER 类型（CPtr 等）Size 为 None/0 → 指针大小 8。
+                    # 根因：t.CPtr.__sizeof__() 返回 0 → list[t.CPtr]
+                    # elem_size=0 → append 全写同槽/alloc(0) → 崩溃。
+                    if getattr(ctype_inst, 'HasPosition', None) \
+                            and ctype_inst.HasPosition(CType.POINTER) \
+                            and size_bytes == 0:
+                        size_bytes = 8
                     return ir.Constant(ir.IntType(64), size_bytes)
                 except Exception as _e:
                     if _config_mode == "strict":