fix(desktop): mm.malloc 显式 CUInt64T 参数规避裸名回退 i32 参数（bg_row_buf 收到 0x0）；fat32 dir_get_entry_info 加 win 缓冲内容诊断（根目录显示 (None) size=523360、dir_find offset=0 失败疑似 win 污染）

VKernel/Kernel/drivers/fs/fat32/fat32_types.vp

@@ -776,6 +776,15 @@ class volinfo:
 	def dir_get_entry_info(self, dp: dirobj | t.CPtr, info: fileinfo | t.CPtr, lfn_buf: t.CUInt16T | t.CPtr) -> FRESULT:
 		res: FRESULT = self._read_entry_from_dir(dp)
 		if res != FRESULT.FR_OK: return FRESULT.FR_DISK_ERR
+		# [DIAG] 定位 win 缓冲污染：磁盘根目录 off=0 应为 "APP" attr=0x10 size=0，
+		# 但运行时显示 (None) size=523360 → win 内容与磁盘不符。
+		_dge: t.CArray[t.CChar, 128]
+		viperlib.snprintf(c.Addr(_dge), 128,
+			"[dge] off=%lu w0=%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x attr=%02x size=%lu winsect=%lx\n",
+			dp.offset, self.win[0], self.win[1], self.win[2], self.win[3],
+			self.win[4], self.win[5], self.win[6], self.win[7], self.win[8],
+			self.win[9], self.win[10], self.win[11 + 0], _read32(c.Addr(self.win[0]), 28), self.winsect)
+		serial.puts(c.Addr(_dge))
 		entry_offset_in_sector: t.CUInt32T = (dp.offset % (512 / ENTRY_SIZE)) * ENTRY_SIZE
 		off: t.CUInt32T = entry_offset_in_sector
 		raw_attr: t.CUInt8T = self.win[off + 11]

VKernel/Kernel/services/desktop.vp

@@ -1848,14 +1848,14 @@ def start(fb_ptr: t.CVoid | t.CPtr, w: t.CInt, h: t.CInt, pitch: t.CInt = 0) ->
     _prev_cursor_x = _cursor_x
     _prev_cursor_y = _cursor_y
 
-    _dirty_rows = mm.malloc(h)
+    _dirty_rows = mm.malloc(t.CUInt64T(h))
     if _dirty_rows:
         string.memset(_dirty_rows, 0, h)
     else:
         serial.puts("[desktop] dirty_rows malloc FAILED\n")
         return None
 
-    _back_fb = mm.malloc(w * h * 4)
+    _back_fb = mm.malloc(t.CUInt64T(w) * t.CUInt64T(h) * 4)
     _dbg_bf: t.CArray[t.CChar, 96]
     viperlib.snprintf(c.Addr(_dbg_bf), 96, "[dbg] back_fb ret=0x%lx w=%d h=%d\n", t.CUInt64T(_back_fb), w, h)
     serial.puts(c.Addr(_dbg_bf))
@@ -1865,7 +1865,7 @@ def start(fb_ptr: t.CVoid | t.CPtr, w: t.CInt, h: t.CInt, pitch: t.CInt = 0) ->
         serial.puts("[desktop] back_fb malloc FAILED\n")
         return None
 
-    _row_buf = mm.malloc(w * 4)
+    _row_buf = mm.malloc(t.CUInt64T(w) * 4)
     _dbg_rb: t.CArray[t.CChar, 96]
     viperlib.snprintf(c.Addr(_dbg_rb), 96, "[dbg] row_buf ret=0x%lx\n", t.CUInt64T(_row_buf))
     serial.puts(c.Addr(_dbg_rb))
@@ -1874,7 +1874,9 @@ def start(fb_ptr: t.CVoid | t.CPtr, w: t.CInt, h: t.CInt, pitch: t.CInt = 0) ->
     else:
         serial.puts("[desktop] row_buf malloc FAILED!\n")
 
-    _bg_row_buf = mm.malloc(w * 4)
+    # mm.malloc(w*4) 走裸名回退生成 call @malloc(i32)，形参 i64 不匹配（第 4 次
+    # 调用 RAX 返回值被破坏收到 0）。显式 CUInt64T 让参数按 i64 传递。
+    _bg_row_buf = mm.malloc(t.CUInt64T(w) * 4)
     _dbg_br: t.CArray[t.CChar, 96]
     viperlib.snprintf(c.Addr(_dbg_br), 96, "[dbg] bg_row_buf ret=0x%lx\n", t.CUInt64T(_bg_row_buf))
     serial.puts(c.Addr(_dbg_br))