diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/cfig_flash.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/cfig_flash.c
index 49a7422..c41ab26 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/cfig_flash.c
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/cfig_flash.c
@@ -245,8 +245,8 @@ void load_cfg_from_flash(void)
            现场: SPI_Flash_Write(参数区 0x00, 512B) → RST=0x00000000 硬件复位
            → magic 写不进 → 无限复位循环。SPI 写触发硬件复位实锤(与快照区无关)。
            临时方案: 不写 Flash, 用内存默认配置继续 (恢复原逻辑删本块即可) */
-        /* 2026-08-17 栈溢出修复: 调试 PRINT 栈峰值触顶(1.9KB栈), #if 0 */
-        /* PRINT("CFG: magic mismatch - MEMORY DEFAULTS (factory SPI write disabled)\n"); */
+        /* 2026-08-17 栈溢出修复后恢复 (栈~4.75KB) */
+        PRINT("CFG: magic mismatch - MEMORY DEFAULTS (factory SPI write disabled)\n");
         memset(g_dev_number, 0, 6);
         memcpy(g_dev_number, gMacAddr, 6);
         sprintf(g_dev_number_str, "%02X%02X%02X%02X%02X%02X",
@@ -290,8 +290,8 @@ void load_cfg_from_flash(void)
         g_sub_code_enable.dgdus_enable = 0;
         g_sub_code_enable.wbdus_enable = 0;
         g_sub_code_enable.radar_enable = 0;
-        /* 2026-08-17 栈溢出修复: #if 0 */
-        /* PRINT("CFG: memory defaults OK (no factory write)\n"); */
+        /* 2026-08-17 栈溢出修复后恢复 */
+        PRINT("CFG: memory defaults OK (no factory write)\n");
         return;
     }
     
@@ -352,6 +352,16 @@ void load_cfg_from_flash(void)
           
 
     
+
+    /* 2026-08-17: 字符串 0 终止保险 — Flash 中字符串若不足定长且后续 0xFF,
+       %s 打印会越界(历史乱码根因之一)。强制定长缓冲末字节为 '\0' */
+    iot_net_info.remote_addr[63] = '\0';
+    iot_net_info.client_id[63]  = '\0';
+    iot_net_info.username[63]   = '\0';
+    iot_net_info.password[31]   = '\0';
+    g_iot_topic.topic_pub[63]   = '\0';
+    g_iot_topic.topic_sub[63]   = '\0';
+
     free(mBuff);
     
     g_sub_code_enable.net_enable = g_sub_code_enable.code_set & 0x01;
@@ -362,8 +372,8 @@ void load_cfg_from_flash(void)
     g_sub_code_enable.wbdus_enable = (g_sub_code_enable.code_set >> 5) & 0x01;
     g_sub_code_enable.radar_enable = (g_sub_code_enable.code_set >> 6) & 0x01;
     
-    /* 2026-08-17 栈溢出修复: #if 0 */
-    /* PRINT("\nSub_Code: 0x%04X, net_enable:%d, iot_enable:%d\n", g_sub_code_enable.code_set, g_sub_code_enable.net_enable, g_sub_code_enable.iot_enable); */
+    /* 2026-08-17 栈溢出修复后恢复 */
+    PRINT("\nSub_Code: 0x%04X, net_enable:%d, iot_enable:%d\n", g_sub_code_enable.code_set, g_sub_code_enable.net_enable, g_sub_code_enable.iot_enable);
     
 //    g_sub_code_enable.laser_enable = (g_sub_code_enable.code_set >> 9) & 0x01;
 //    g_sub_code_enable.lora_enable = (g_sub_code_enable.code_set >> 15) & 0x01;
diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/peripheral_main.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/peripheral_main.c
index f83bb49..f918544 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/peripheral_main.c
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/peripheral_main.c
@@ -357,15 +357,13 @@ int main(void)
         OFFLOG_RCC_RSTSCKR |= OFFLOG_RST_RMVF;   /* RMVF (bit24): 清复位标志 */
     }
 
-    /* ===== 栈溢出修复 (2026-08-17): 实验D确认 load_cfg/output_cfg 为触发点 =====
-       .bss≈46KB → 栈仅~1.9KB; load_cfg 的 printf 栈峰值触顶 → 跑飞。
-       修复: load_cfg 恢复(保留配置加载), 其内部调试 PRINT 已 #if 0 (cfig_flash.c);
-             output_cfg 全部为调试打印, 调用暂 #if 0 (栈峰值来源)。
-       根治: 减 .bss 给栈腾 4KB+ (待 .map 确认大数组) */
+    /* ===== 栈溢出修复闭环 (2026-08-17) =====
+       根因: .bss≈46KB → 栈仅~1.9KB; load_cfg/output_cfg 的 printf 栈峰值触顶
+       → 覆盖 .noinit+返回地址 → PC 跑飞循环。
+       修复: ①实验D定位触发点 ②RAM 瘦身 (ETH 768/payload 800/MQTT buf 800,
+       栈 1.9KB→~4.75KB) ③load_cfg 字符串 0 终止保险 ④打印恢复。 */
     load_cfg_from_flash();
-#if 0
-    output_cfg_from_flash();   /* 调试打印专用, 栈峰值高, 恢复前需减栈压力 */
-#endif
+    output_cfg_from_flash();   /* 2026-08-17: 栈瘦身后恢复 (栈~4.75KB, printf 峰值安全) */
 #endif
 
     PRINT("MAC: %02X %02X %02X %02X %02X %02X\r\n", gMacAddr[0],gMacAddr[1], gMacAddr[2], gMacAddr[3],gMacAddr[4],gMacAddr[5]);