diff --git a/includes/memhub.vp b/includes/memhub.vp
index f64d733..418523f 100644
--- a/includes/memhub.vp
+++ b/includes/memhub.vp
@@ -833,13 +833,19 @@ class MemBuddy(MemManager):
             p: t.CUInt64T = self._det_records[i * 2]
             s: t.CUInt64T = self._det_records[i * 2 + 1]
             if (s & free_flag) != 0:
-                # free 记录：块头仍为 0（未被重新 alloc）则验证用户区 0xCD
-                # 完整——被写穿 = use-after-free 写入（free 后块被某代码覆盖）
+                # free 记录：块头仍为 0（未被重新 alloc）则验证前标记 + 用户区
+                # 0xCD 完整——被写穿 = use-after-free 写入 / 下溢写
                 real_s: t.CUInt64T = s & (free_flag - 1)
                 if real_s > 0:
                     blk_h: t.CUInt64T = p - 2 - MEMBUDDY_HEADER_SIZE
                     hdr_v: t.CUInt64T = t.CUInt64T(c.Deref(t.CUInt64T(blk_h, t.CPtr)))
                     if (hdr_v & 1) == 0:
+                        m_fr: t.CUInt16T | t.CPtr = (t.CUInt16T | t.CPtr)(t.CVoid(p - 2, t.CPtr))
+                        mfv_r: t.CUInt16T = m_fr[0]
+                        if mfv_r != t.CUInt16T(MEMBUDDY_DET_MARKER):
+                            stdio.printf("[DET] 下溢写: ptr=%llu size=%llu（free 后前标记被破坏，前标记=0x%04X）\n",
+                                         p, real_s, t.CUInt32T(mfv_r))
+                            stdlib.exit(1)
                         w0: t.CUInt64T = t.CUInt64T(c.Deref(t.CUInt64T(p, t.CPtr)))
                         w1: t.CUInt64T = w0
                         if real_s >= 8:
@@ -853,6 +859,13 @@ class MemBuddy(MemManager):
             if s == 0:
                 i += 1
                 continue  # 无 size 记录（理论不发生，防御）
+            # active 记录：前标记（下溢检测）+ 后标记（上溢检测）
+            m_fa: t.CUInt16T | t.CPtr = (t.CUInt16T | t.CPtr)(t.CVoid(p - 2, t.CPtr))
+            mfv_a: t.CUInt16T = m_fa[0]
+            if mfv_a != t.CUInt16T(MEMBUDDY_DET_MARKER):
+                stdio.printf("[DET] 下溢写: ptr=%llu size=%llu 前标记=0x%04X（期望 0xCDCD）\n",
+                             p, s, t.CUInt32T(mfv_a))
+                stdlib.exit(1)
             m16: t.CUInt16T | t.CPtr = (t.CUInt16T | t.CPtr)(t.CVoid(p + s, t.CPtr))
             mv: t.CUInt16T = m16[0]
             if mv != t.CUInt16T(MEMBUDDY_DET_MARKER):