diff --git a/VKernel/Kernel/drivers/storage/ide/ide.vp b/VKernel/Kernel/drivers/storage/ide/ide.vp
index 3943256..256828d 100644
--- a/VKernel/Kernel/drivers/storage/ide/ide.vp
+++ b/VKernel/Kernel/drivers/storage/ide/ide.vp
@@ -92,7 +92,7 @@ def readSector(lba: t.CUInt32T, buffer: t.CVoid | t.CPtr) -> t.CInt:
         viperlib.snprintf(c.Addr(dbg), 120, "[readSector] waitReady err=%d\n", t.CInt(err))
         serial.puts(dbg)
         return err
-    asm.outb(0x3F6, 0x02)
+    asm.outb(0x3F6, 0x00)
     asm.outb(0x1F2, 1)
     asm.outb(0x1F3, t.CUInt8T(lba & 0xFF))
     asm.outb(0x1F4, t.CUInt8T((lba >> 8) & 0xFF))
@@ -119,7 +119,7 @@ def writeSector(lba: t.CUInt32T, buffer: t.CConst | t.CVoid | t.CPtr) -> t.CInt:
     if buffer is None: return IDError.IDE_ERR_BUFFER_NULL
     err: IDError = waitReady(IDE_baseport_PRIMARY)
     if err != IDError.IDE_ERR_NONE: return err
-    asm.outb(0x3F6, 0x02)
+    asm.outb(0x3F6, 0x00)
     asm.outb(0x1F2, 1)
     asm.outb(0x1F3, t.CUInt8T(lba & 0xFF))
     asm.outb(0x1F4, t.CUInt8T((lba >> 8) & 0xFF))
diff --git a/VKernel/Kernel/execrunner/elf.vp b/VKernel/Kernel/execrunner/elf.vp
index be34efc..c5438f3 100644
--- a/VKernel/Kernel/execrunner/elf.vp
+++ b/VKernel/Kernel/execrunner/elf.vp
@@ -322,6 +322,12 @@ def _elf_entry_wrapper(arg: t.CVoid | t.CPtr) -> t.CInt:
     proc.switch_pid(pid)
     cur_p: proc.Process | t.CPtr = proc.ProcessManager.current()
     entry_fn: t.CVoid | t.CPtr = cur_p.entry
+    # [DIAG] 定位用户进程首个指令 PF：打印 entry 实际值（PF cr2=ELF 物理区最后一页，
+    # 疑似 entry 被写成 phys 地址而非虚拟 0x400000）。
+    _dbw: t.CArray[t.CChar, 160]
+    viperlib.snprintf(c.Addr(_dbw), 160, "[wrap] pid=%d cur=0x%lx ent=0x%lx ebase=0x%lx ks=0x%lx us=0x%lx\n",
+        pid, t.CUInt64T(cur_p), t.CUInt64T(entry_fn), cur_p.elf_base, cur_p.kern_stack, cur_p.user_stack)
+    serial.puts(c.Addr(_dbw))
     if entry_fn is not None:
         user_stack_vtop: t.CUInt64T = USER_STACK_VTOP
         us_sz: t.CUInt64T = USER_STACK_SIZE
@@ -442,7 +448,10 @@ def spawn_elf(path: t.CConst | str) -> t.CInt:
     paging.set_active_pml4(_kernel_cr3)
     asm.sti()
 
-    p: proc.Process | t.CPtr = proc.ProcessManager.create_process(path[name_start:], entry)
+    # path[name_start:] 切片表达式 translate_subscript 不支持 Slice（返回 None）→
+    # 作为实参丢 name、entry 错位成第一参数（TPV 已修，此处指针算术双保险）
+    nm_ptr: t.CConst | t.CChar | t.CPtr = t.CConst(t.CUInt64T(path) + t.CUInt64T(name_start), t.CPtr)
+    p: proc.Process | t.CPtr = proc.ProcessManager.create_process(nm_ptr, entry)
     if p is None:
         serial.puts("[elf] spawn: create_process failed\n")
         fat32.unlock()
@@ -463,6 +472,10 @@ def spawn_elf(path: t.CConst | str) -> t.CInt:
     slog: t.CArray[t.CChar, 80]
     viperlib.snprintf(c.Addr(slog), 80, "[elf] spawn: pid=%d tid=%d entry=0x%lx pml4=0x%lx\n", p.pid, tid, t.CUInt64T(entry), p.pml4_root)
     serial.puts(slog)
+    # [DIAG] 确认 return p.pid 的实际值（main 收到 pid=0 而此处打印 3）
+    _dbw2: t.CArray[t.CChar, 64]
+    viperlib.snprintf(c.Addr(_dbw2), 64, "[elf] spawn ret pid=%d\n", p.pid)
+    serial.puts(c.Addr(_dbw2))
     fat32.unlock()
     return p.pid