diff --git a/VKernel/Kernel/execrunner/elf.vp b/VKernel/Kernel/execrunner/elf.vp
index a2b4aca..3275859 100644
--- a/VKernel/Kernel/execrunner/elf.vp
+++ b/VKernel/Kernel/execrunner/elf.vp
@@ -130,10 +130,12 @@ def load_elf(path: t.CConst | str, do_map: t.CInt = 1) -> t.CVoid | t.CPtr:
     ehdr_buf: t.CArray[t.CUInt8T, 64]
     string.memset(c.Addr(ehdr_buf), 0, 64)
     read_len: t.CUInt32T = fat32.read(fp, c.Addr(ehdr_buf), 64)
-    # [DIAG] read_len 实际值（fat32.read 内部打印 br=64 但 load_elf 收到 <64
-    # 触发 "failed to read ehdr" —— 跨模块返回值间歇性丢失）
-    _dbrl: t.CArray[t.CChar, 64]
-    viperlib.snprintf(c.Addr(_dbrl), 64, "[elf] read_len=%lu\n", read_len)
+    # [DIAG] read_len 实际值 + call 后 RAX 快照：区分"call 返回错"（rl=0 rax=0）
+    # vs "store 后 RAX 被覆盖"（rl=0 rax=64）
+    _rax_v2: t.CUInt64T = 0
+    c.Asm(f"""mov {c.AsmOut(_rax_v2, t.ASM_DESCR.OUTPUT_REG)}, rax""", op=[t.ASM_DESCR.CLOBBER_MEMORY])
+    _dbrl: t.CArray[t.CChar, 96]
+    viperlib.snprintf(c.Addr(_dbrl), 96, "[elf] rl=%lu rax=0x%lx\n", read_len, _rax_v2)
     serial.puts(c.Addr(_dbrl))
     if read_len < 64:
         serial.puts("[elf] failed to read ehdr\n")