diff --git a/VKernel/Kernel/intr/idt.vp b/VKernel/Kernel/intr/idt.vp
index d00ed2d..1686761 100644
--- a/VKernel/Kernel/intr/idt.vp
+++ b/VKernel/Kernel/intr/idt.vp
@@ -177,6 +177,31 @@ def isrCommonhandler(interrupt: t.CInt):
         ex_buf: t.CArray[t.CChar, 100]
         viperlib.snprintf(c.Addr(ex_buf), 100, "[EX] int=%d rip=0x%lx rsp=0x%lx\n", interrupt, ex_rip, ex_rsp)
         serial.puts(ex_buf)
+        # [STK] rbp 链回溯（与 #PF 分支一致，定位栈损坏源）
+        fr0: t.CUInt64T = 0
+        fr1: t.CUInt64T = 0
+        fr2: t.CUInt64T = 0
+        fr3: t.CUInt64T = 0
+        fr4: t.CUInt64T = 0
+        c.Asm(f"""mov rax, [_fault_rbp]
+                mov {c.AsmOut(fr0, t.ASM_DESCR.OUTPUT_REG)}, rax
+                mov rax, [rax + 8]
+                mov {c.AsmOut(fr1, t.ASM_DESCR.OUTPUT_REG)}, rax
+                mov rax, [_fault_rbp]
+                mov rax, [rax]
+                mov {c.AsmOut(fr2, t.ASM_DESCR.OUTPUT_REG)}, rax
+                mov rax, [rax + 8]
+                mov {c.AsmOut(fr3, t.ASM_DESCR.OUTPUT_REG)}, rax
+                mov rax, [_fault_rbp]
+                mov rax, [rax]
+                mov rax, [rax]
+                mov rax, [rax + 8]
+                mov {c.AsmOut(fr4, t.ASM_DESCR.OUTPUT_REG)}, rax""",
+              op=[t.ASM_DESCR.CLOBBER_RAX])
+        stk_buf: t.CArray[t.CChar, 160]
+        viperlib.snprintf(c.Addr(stk_buf), 160, "[STK] rbp=0x%lx ret: 0x%lx 0x%lx 0x%lx 0x%lx\n",
+                          fr0, fr1, fr2, fr3, fr4)
+        serial.puts(stk_buf)
     s: sched.Scheduler | t.CPtr = sched._sched_ptr
     # 如果调度器未初始化，直接进入安全停机状态
     if s == 0: