diff --git a/VKernel/Kernel/paging/paging.vp b/VKernel/Kernel/paging/paging.vp
index 5c43e4c..ad3f682 100644
--- a/VKernel/Kernel/paging/paging.vp
+++ b/VKernel/Kernel/paging/paging.vp
@@ -422,7 +422,8 @@ def clone_for_process(isolate_vaddr: t.CUInt64T) -> t.CUInt64T:
 def save_pt_range(vaddr_start: t.CUInt64T, vaddr_end: t.CUInt64T, save_buf: t.CUInt64T | t.CPtr, save_count: t.CUInt32T | t.CPtr) -> t.CInt:
     global pml4
     if not pml4: return -1
-    c.Set(save_count, t.CUInt32T(0))
+    # c.Set(a,b)=a=b（改指针变量本身）；写所指地址必须 c.Set(c.Deref(a),b)
+    c.Set(c.Deref(save_count), t.CUInt32T(0))
     va: t.CUInt64T = vaddr_start & ~t.CUInt64T(0xFFF)
     while va < vaddr_end:
         pml4_idx: t.CUInt64T = (va >> 39) & 0x1FF
@@ -440,7 +441,7 @@ def save_pt_range(vaddr_start: t.CUInt64T, vaddr_end: t.CUInt64T, save_buf: t.CU
         entry_ptr: t.CUInt64T | t.CPtr = save_buf + t.CUInt64T(saved) * 16
         c.DerefAs(entry_ptr, va)
         c.DerefAs(entry_ptr + 8, pt_.entries[pt_idx])
-        c.Set(save_count, t.CUInt32T(saved + 1))
+        c.Set(c.Deref(save_count), t.CUInt32T(saved + 1))
         va += 0x1000
     return 0