diff --git a/VKernel/Kernel/intr/idt.vp b/VKernel/Kernel/intr/idt.vp
index 2b319d2..5bbd473 100644
--- a/VKernel/Kernel/intr/idt.vp
+++ b/VKernel/Kernel/intr/idt.vp
@@ -153,8 +153,12 @@ def isrCommonhandler(interrupt: t.CInt):
                 mov {c.AsmOut(fr4, t.ASM_DESCR.OUTPUT_REG)}, rax""",
               op=[t.ASM_DESCR.CLOBBER_RAX])
         stk_buf: t.CArray[t.CChar, 160]
-        viperlib.snprintf(c.Addr(stk_buf), 160, "[STK] rbp=0x%lx ret: 0x%lx 0x%lx 0x%lx 0x%lx\n",
-                          fr0, fr1, fr2, fr3, fr4)
+        if fr0 >= 0x80000000:
+            # 用户态 rbp（如 0x7fffff...）：回溯会读用户栈地址 → 嵌套 #PF 死循环
+            viperlib.snprintf(c.Addr(stk_buf), 160, "[STK] user rbp=0x%lx, chain skipped\n", fr0)
+        else:
+            viperlib.snprintf(c.Addr(stk_buf), 160, "[STK] rbp=0x%lx ret: 0x%lx 0x%lx 0x%lx 0x%lx\n",
+                              fr0, fr1, fr2, fr3, fr4)
         serial.puts(stk_buf)
     elif interrupt == 13:
         gp_rip: t.CUInt64T = 0
@@ -213,8 +217,12 @@ def isrCommonhandler(interrupt: t.CInt):
                 mov {c.AsmOut(fr4, t.ASM_DESCR.OUTPUT_REG)}, rax""",
               op=[t.ASM_DESCR.CLOBBER_RAX])
         stk_buf: t.CArray[t.CChar, 160]
-        viperlib.snprintf(c.Addr(stk_buf), 160, "[STK] rbp=0x%lx ret: 0x%lx 0x%lx 0x%lx 0x%lx\n",
-                          fr0, fr1, fr2, fr3, fr4)
+        if fr0 >= 0x80000000:
+            # 用户态 rbp（如 0x7fffff...）：回溯会读用户栈地址 → 嵌套 #PF 死循环
+            viperlib.snprintf(c.Addr(stk_buf), 160, "[STK] user rbp=0x%lx, chain skipped\n", fr0)
+        else:
+            viperlib.snprintf(c.Addr(stk_buf), 160, "[STK] rbp=0x%lx ret: 0x%lx 0x%lx 0x%lx 0x%lx\n",
+                              fr0, fr1, fr2, fr3, fr4)
         serial.puts(stk_buf)
     s: sched.Scheduler | t.CPtr = sched._sched_ptr
     # 如果调度器未初始化，直接进入安全停机状态