diff --git a/App/lib/core/Gen/Expr/ExprGenFstr.vp b/App/lib/core/Gen/Expr/ExprGenFstr.vp
index 1df465a..7748aba 100644
--- a/App/lib/core/Gen/Expr/ExprGenFstr.vp
+++ b/App/lib/core/Gen/Expr/ExprGenFstr.vp
@@ -193,9 +193,13 @@ novirtual class ExprGenFstr(ExprGenBase.ExprGenBase):
             snprintf_decl: mlirlite.Function* = mlirlite.create_declare(pool, mod, "snprintf", i32_ty)
             if snprintf_decl is not None:
                 snprintf_decl.IsVarArg = 1
-                mlirlite.add_param(pool, snprintf_decl, i8_ty, "buf")
+                # buf/fmt 是指针参数（i8*），**不是**元素类型 i8（buf_ty 的 elem）：
+                # 调用侧传 buf_ptr/fmt_ptr（i8*），declare 若写成裸 i8 → MLIR
+                # 'llvm.call' operand type mismatch '!llvm.ptr' != 'i8'（ZlibDbg 根因）。
+                i8_ptr_ty: mlirlite.LLVMType* = mlirlite.Ptr(pool, i8_ty)
+                mlirlite.add_param(pool, snprintf_decl, i8_ptr_ty, "buf")
                 mlirlite.add_param(pool, snprintf_decl, mlirlite.Int64(pool), "size")
-                mlirlite.add_param(pool, snprintf_decl, i8_ty, "fmt")
+                mlirlite.add_param(pool, snprintf_decl, i8_ptr_ty, "fmt")
         # snprintf(buf, FSTR_BUF_SIZE, fmt, args...)
         size_val: mlirlite.Value* = mlirlite.const_int64(pool, FSTR_BUF_SIZE)
         buf_ptr.Next = size_val