diff --git a/VKernel/Kernel/drivers/devfs/devfs.vp b/VKernel/Kernel/drivers/devfs/devfs.vp
index 84e2cde..922ebd6 100644
--- a/VKernel/Kernel/drivers/devfs/devfs.vp
+++ b/VKernel/Kernel/drivers/devfs/devfs.vp
@@ -36,14 +36,13 @@ class devfs_directory:
         result: t.CArray[str, PATH_BUFFER_SIZE]
         token = string.split(path, "/", result)
 
-        # 只遍历 split 返回的 token 数：`for i in result` 会全量遍历 256 槽，
-        # 而 split 只在末尾设 NULL 哨兵、其余槽是栈垃圾 → samestr→strcmp 解引用
-        # NULL/垃圾 → #PF（open("/dev/serial0") 走 find("/dev") 时 B1 崩溃根因）。
-        for ti in range(token):
+        # `for i in result` 按 NULL 终止语义遍历（i8* 元素，split 尾哨兵 NULL 停）：
+        # 编译器 _handle_array_iter 已实现"长度上限 + 解引用为空提前终止"。
+        for i in result:
             found: bool = False
             for d in range(directory_count):
                 dirp: devfs_directory = c.Addr(directories[d])
-                if dirp.parent == current_dir and string.samestr(dirp.name, result[ti]):
+                if dirp.parent == current_dir and string.samestr(dirp.name, i):
                     current_dir = dirp
                     found = True
                     break