diff --git a/VKernel/Kernel/drivers/devfs/devfs.vp b/VKernel/Kernel/drivers/devfs/devfs.vp
index 62051aa..84e2cde 100644
--- a/VKernel/Kernel/drivers/devfs/devfs.vp
+++ b/VKernel/Kernel/drivers/devfs/devfs.vp
@@ -36,11 +36,14 @@ class devfs_directory:
         result: t.CArray[str, PATH_BUFFER_SIZE]
         token = string.split(path, "/", result)
 
-        for i in result:
+        # 只遍历 split 返回的 token 数：`for i in result` 会全量遍历 256 槽，
+        # 而 split 只在末尾设 NULL 哨兵、其余槽是栈垃圾 → samestr→strcmp 解引用
+        # NULL/垃圾 → #PF（open("/dev/serial0") 走 find("/dev") 时 B1 崩溃根因）。
+        for ti in range(token):
             found: bool = False
             for d in range(directory_count):
                 dirp: devfs_directory = c.Addr(directories[d])
-                if dirp.parent == current_dir and string.samestr(dirp.name, i):
+                if dirp.parent == current_dir and string.samestr(dirp.name, result[ti]):
                     current_dir = dirp
                     found = True
                     break