diff --git a/VKernel/Kernel/intr/syscall.vp b/VKernel/Kernel/intr/syscall.vp
index d77cd3f..860ed3d 100644
--- a/VKernel/Kernel/intr/syscall.vp
+++ b/VKernel/Kernel/intr/syscall.vp
@@ -62,8 +62,12 @@ def wrmsr(msr: t.CUInt32T, val: t.CUInt64T):
 def rdmsr(msr: t.CUInt32T) -> t.CUInt64T:
     lo: t.CUInt32T
     hi: t.CUInt32T
+    # rdmsr 固定写 EDX:EAX；out 绑定 + CLOBBER_RAX/RDX 冲突会导致 lo/hi
+    # 分配到非 EAX/EDX 读到垃圾。显式 mov 到输出寄存器（与 asm.inb 修复同模式）。
     c.Asm(f"""mov ecx, {c.AsmInp(msr, t.ASM_DESCR.REG_ANY)}
-              rdmsr""",
+              rdmsr
+              mov {c.AsmOut(lo, t.ASM_DESCR.OUTPUT_REG)}, eax
+              mov {c.AsmOut(hi, t.ASM_DESCR.OUTPUT_REG)}, edx""",
           out=[c.AsmOut(lo, t.ASM_DESCR.OUTPUT_REG), c.AsmOut(hi, t.ASM_DESCR.OUTPUT_REG)],
           op=[t.ASM_DESCR.CLOBBER_RCX, t.ASM_DESCR.CLOBBER_RAX, t.ASM_DESCR.CLOBBER_RDX])
     return t.CUInt64T(lo) | (t.CUInt64T(hi) << 32)
diff --git a/VKernel/Kernel/mm/mm.vp b/VKernel/Kernel/mm/mm.vp
index 50f56e5..633dbff 100644
--- a/VKernel/Kernel/mm/mm.vp
+++ b/VKernel/Kernel/mm/mm.vp
@@ -764,10 +764,18 @@ def vm_free(VirtAddr: t.CUInt64T):
 
 # CMOS读取函数
 def cmos_read(reg: t.CUInt8T) -> t.CUInt8T:
-    c.Asm(f"mov al, {c.AsmInp(reg)}\nout 0x70, al")
-    val: t.CUInt8T
-    c.Asm(f"in al, 0x71\nmov {c.AsmOut(val)}, al")
-    return val
+    # in/out al 会改 EAX，必须 CLOBBER_RAX；显式 mov 到输出寄存器
+    #（与 asm.inb/inw 修复同模式，避免调用方 EAX 被静默破坏）。
+    c.Asm(f"""mov eax, {c.AsmInp(t.CUInt32T(reg), t.ASM_DESCR.REG_ANY)}
+              out 0x70, al""",
+          op=[t.ASM_DESCR.CLOBBER_RAX])
+    val32: t.CUInt32T
+    c.Asm(f"""in al, 0x71
+              movzx eax, al
+              mov {c.AsmOut(val32, t.ASM_DESCR.OUTPUT_REG)}, eax""",
+          out=[c.AsmOut(val32, t.ASM_DESCR.OUTPUT_REG)],
+          op=[t.ASM_DESCR.CLOBBER_RAX])
+    return t.CUInt8T(val32)
 
 # 内存大小测试函数
 def detect_memory_size() -> t.CUInt64T: