diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c
index 940a406..8c30c67 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c
@@ -71,7 +71,9 @@ static int iot_make_topic(char *out, uint16_t out_len, const char *direction,
 /* 发送 MQTT 报文到 broker */
 static int iot_mqtt_send(const uint8_t *buf, uint16_t len) {
     uint16_t slen = len;
+    PRINT("IOT: SocketSend sock=%d len=%d\n", g_iot_socket, len);
     uint8_t ret = WCHNET_SocketSend(g_iot_socket, (uint8_t *)buf, &slen);
+    PRINT("IOT: SocketSend ret=0x%02X sent=%d\n", ret, slen);
     return (ret == WCHNET_ERR_SUCCESS) ? 0 : -1;
 }
 
@@ -390,7 +392,7 @@ void iot_mqtt_publish_sensor(void) {
     }
 
     /* 构建 loop_data JSON */
-    char data_json[2048];
+    static char data_json[2048];   // static: 避免 2KB 栈溢出
     char *p = data_json;
     int remaining = sizeof(data_json);
     int written;
@@ -433,7 +435,7 @@ void iot_mqtt_publish_sensor(void) {
     snprintf(p, remaining, "]}");
 
     /* 包装为通用消息格式 */
-    char payload[IOT_MQTT_SEND_BUF_LEN];
+    static char payload[IOT_MQTT_SEND_BUF_LEN];  // static: 避免 2KB 栈溢出
     snprintf(payload, sizeof(payload),
         "{\"msg_id\":%d,\"cmd\":\"loop_data\",\"ts\":%lu,\"data\":%s}",
         ++g_iot_msg_id, mstick() / 1000, data_json);