diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/tcp_json_srv.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/tcp_json_srv.c
index 0e5e09d..749eb4c 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/tcp_json_srv.c
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/tcp_json_srv.c
@@ -36,6 +36,7 @@ uint32_t g_json_lockout_timer = 0;
  *===========================================================================*/
 static uint8_t  g_json_recv_buf[TCP_JSON_RECV_BUF_LEN];
 static uint16_t g_json_recv_len = 0;
+static uint8_t  g_json_wchnet_buf[RECE_BUF_LEN];  // WCHNET internal recv buffer
 
 /*===========================================================================
  * Internal helpers
@@ -647,8 +648,9 @@ void tcp_json_handle_sock_int(uint8_t socketid, uint8_t intstat) {
         memset(g_json_recv_buf, 0, sizeof(g_json_recv_buf));
         
         // CRITICAL: Set up receive buffer for the accepted TCP socket
-        // Without this, WCHNET won't buffer incoming data on this socket
-        WCHNET_ModifyRecvBuf(socketid, (uint32_t)g_json_recv_buf, TCP_JSON_RECV_BUF_LEN);
+        // Use a SEPARATE buffer for WCHNET — not g_json_recv_buf
+        // WCHNET_SocketRecv copies FROM this buffer, so it must not overlap
+        WCHNET_ModifyRecvBuf(socketid, (uint32_t)g_json_wchnet_buf, RECE_BUF_LEN);
         
         PRINT("JSON: Client accepted on socket %d, recv buf configured\n", socketid);
         return;
@@ -657,13 +659,16 @@ void tcp_json_handle_sock_int(uint8_t socketid, uint8_t intstat) {
     // === Client socket events ===
     if (socketid == g_json_socket_client) {
         if (intstat & SINT_STAT_RECV) {
-            // Read data into frame buffer
+            // Read data from WCHNET's buffer into our frame accumulator
             uint32_t recv_len = WCHNET_SocketRecvLen(socketid, NULL);
             if (recv_len > 0) {
                 uint16_t space = TCP_JSON_RECV_BUF_LEN - g_json_recv_len;
                 if (recv_len > space) recv_len = space;
                 uint32_t rd_len = recv_len;
-                WCHNET_SocketRecv(socketid, g_json_recv_buf + g_json_recv_len, &rd_len);
+                // Read into a temp buffer first, then append to frame buffer
+                uint8_t tmp_buf[RECE_BUF_LEN];
+                WCHNET_SocketRecv(socketid, tmp_buf, &rd_len);
+                memcpy(g_json_recv_buf + g_json_recv_len, tmp_buf, (uint16_t)rd_len);
                 g_json_recv_len += (uint16_t)rd_len;
 
                 // Process complete frames