diff --git a/VKernel/Kernel/drivers/fs/fat32/fat32_types.vp b/VKernel/Kernel/drivers/fs/fat32/fat32_types.vp
index 29a0755..75f89c5 100644
--- a/VKernel/Kernel/drivers/fs/fat32/fat32_types.vp
+++ b/VKernel/Kernel/drivers/fs/fat32/fat32_types.vp
@@ -732,6 +732,14 @@ class volinfo:
 				_db2: t.CArray[t.CChar, 80]
 				viperlib.snprintf(c.Addr(_db2), 80, "[dir_find] dir_read_entry failed res=%d offset=%lu\n", t.CInt(res), dp.offset)
 				serial.puts(_db2)
+				# [DIAG] win 缓冲内容 dump（磁盘数据正确但运行时 win 被污染时可见）
+				_dbw: t.CArray[t.CChar, 96]
+				viperlib.snprintf(c.Addr(_dbw), 96, "[dir_find] win=%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x ws=%lx\n",
+					self.win[0], self.win[1], self.win[2], self.win[3],
+					self.win[4], self.win[5], self.win[6], self.win[7],
+					self.win[8], self.win[9], self.win[10], self.win[11],
+					self.win[12], self.win[13], self.win[14], self.win[15], self.winsect)
+				serial.puts(c.Addr(_dbw))
 				return res
 			entry_sector:           t.CUInt64T = dp.sector + (dp.offset / (512 / ENTRY_SIZE))
 			entry_offset_in_sector: t.CUInt32T = (dp.offset % (512 / ENTRY_SIZE)) * ENTRY_SIZE
diff --git a/VKernel/Kernel/paging/paging.vp b/VKernel/Kernel/paging/paging.vp
index 22adf3c..2ace17a 100644
--- a/VKernel/Kernel/paging/paging.vp
+++ b/VKernel/Kernel/paging/paging.vp
@@ -205,6 +205,12 @@ def clone_for_process(isolate_vaddr: t.CUInt64T) -> t.CUInt64T:
     if not pml4: return 0
     new_pml4_page: _p | t.CPtr = AllocPage()
     if not new_pml4_page:
+        # [DIAG] 定位 AllocPage 失败：pool_used 打印 0 但分配失败 → BSS 全局
+        # （pt_pool_raw/pt_pool_used）疑似被内存越界写覆盖。
+        _dbgf: t.CArray[t.CChar, 120]
+        viperlib.snprintf(c.Addr(_dbgf), 120, "[clone] AllocPage FAIL raw=0x%lx used=%lu PP=%d\n",
+            t.CUInt64T(pt_pool_raw), pt_pool_used, PT_POOL_PAGES)
+        serial.puts(c.Addr(_dbgf))
         serial.puts("[clone] AllocPage pml4 failed\n")
         return 0
     _dbg2: t.CArray[t.CChar, 120]
diff --git a/VKernel/Kernel/sched/process.vp b/VKernel/Kernel/sched/process.vp
index 18c59e5..ae2eae0 100644
--- a/VKernel/Kernel/sched/process.vp
+++ b/VKernel/Kernel/sched/process.vp
@@ -1,5 +1,4 @@
-import mm
-import mm.mm as mm_mm
+import mm.mm as mm
 import paging.paging as paging
 import drivers.serial.uart.serial as serial
 import drivers.fs.fat32.fat32 as fat32
@@ -192,6 +191,10 @@ class ProcessManager:
             p.dir_used[j] = 0
             p.dir_table[j] = t.CVoid(0, t.CPtr)
         ks: t.CVoid | t.CPtr = mm_mm.malloc(KERN_STACK_SIZE)
+        # [DIAG] 定位跨模块 malloc 返回值（mm 成功但调用方收到 None）
+        _dbg_ks: t.CArray[t.CChar, 64]
+        viperlib.snprintf(c.Addr(_dbg_ks), 64, "[proc] ks=0x%lx\n", t.CUInt64T(ks))
+        serial.puts(c.Addr(_dbg_ks))
         if ks is None:
             serial.puts("[process] kernel stack alloc failed\n")
             m.count = m.count - 1
@@ -199,6 +202,10 @@ class ProcessManager:
         ks_size: t.CUInt64T = KERN_STACK_SIZE
         p.kern_stack = t.CUInt64T(ks) + ks_size
         us: t.CVoid | t.CPtr = mm_mm.malloc(USER_STACK_SIZE)
+        # [DIAG] 定位 user_stack 收到 None（mm 内部打印成功但此处收 0x0）
+        _dbg_us: t.CArray[t.CChar, 64]
+        viperlib.snprintf(c.Addr(_dbg_us), 64, "[proc] us=0x%lx\n", t.CUInt64T(us))
+        serial.puts(c.Addr(_dbg_us))
         if us is None:
             serial.puts("[process] user stack alloc failed\n")
             mm_mm.free(ks)
@@ -213,7 +220,7 @@ class ProcessManager:
 
 _proc_mgr:     ProcessManager = ProcessManager()
 _proc_mgr_ptr: ProcessManager | t.CPtr = c.Addr(_proc_mgr)
-_saved_cr3:    t.CUInt64T
+_saved_cr3:    t.CUInt64T | t.CExport
 
 def current() -> t.CInt:
     m: ProcessManager | t.CPtr = _proc_mgr_ptr