diff --git a/includes/memhub.vp b/includes/memhub.vp
index 0db8107..8eabae5 100644
--- a/includes/memhub.vp
+++ b/includes/memhub.vp
@@ -537,9 +537,20 @@ class MemBuddy(MemManager):
                     c.DerefAs(block, t.CVoid(t.CUInt64T((order << 1) | 1), t.CPtr))
                     result = t.CVoid(t.CUInt64T(block) + MEMBUDDY_HEADER_SIZE, t.CPtr)
                     # 记录到 checkpoint 栈（供 reset_to 回收）
-                    if self.chk_stack is not None and self.chk_depth < self.chk_cap:
-                        self.chk_stack[self.chk_depth] = t.CUInt64T(block)
-                        self.chk_depth += 1
+                    # 栈满时 stdlib.realloc 翻倍扩容（防 64K 爆满后记录缺失
+                    # → reset 不回收 + _is_valid_ptr 栈校验退化的连锁问题）
+                    if self.chk_stack is not None:
+                        if self.chk_depth >= self.chk_cap:
+                            new_cap: t.CSizeT = self.chk_cap * 2
+                            new_stack: t.CVoid | t.CPtr = t.CVoid(
+                                stdlib.realloc(self.chk_base, new_cap * 8), t.CPtr)
+                            if new_stack is not None:
+                                self.chk_base = new_stack
+                                self.chk_stack = (t.CUInt64T | t.CPtr)(t.CVoid(new_stack, t.CPtr))
+                                self.chk_cap = new_cap
+                        if self.chk_depth < self.chk_cap:
+                            self.chk_stack[self.chk_depth] = t.CUInt64T(block)
+                            self.chk_depth += 1
         if result is None:
             # 分配失败（alloc(0) 或池耗尽）：解锁并返回 None，由调用者决定后续处理。
             # 不能 exit——测试依赖 alloc 失败返回 None 后继续 free+重试