diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c
index a083297..c7a77cc 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c
@@ -290,13 +290,24 @@ static int iot_make_topic(char *out, uint16_t out_len, const char *direction,
  * MQTT Packet Helpers
  *===========================================================================*/
 
-/* 发送 MQTT 报文到 broker */
+/* 发送 MQTT 报文到 broker — 循环重试防 WCHNET 部分发送
+   (2026-07-23: SocketSend 只发 520/607B → 残留拼到下行 → broker 见垃圾 → _raw+RST) */
 static int iot_mqtt_send(const uint8_t *buf, uint16_t len) {
-    uint32_t slen = len;  /* 必须是 uint32_t: WCHNET_SocketSend 写 4 字节, uint16_t 会栈破坏致 hard fault */
-    PRINT("IOT: SocketSend sock=%d len=%lu\n", g_iot_socket, (unsigned long)slen);
-    uint8_t ret = WCHNET_SocketSend(g_iot_socket, (uint8_t *)buf, &slen);
-    PRINT("IOT: SocketSend ret=0x%02X sent=%lu\n", ret, (unsigned long)slen);
-    return (ret == WCHNET_ERR_SUCCESS) ? 0 : -1;
+    uint16_t total_sent = 0;
+    int retries = 0;
+    PRINT("IOT: SocketSend sock=%d len=%u\n", g_iot_socket, len);
+    while (total_sent < len) {
+        uint32_t slen = len - total_sent;
+        uint8_t ret = WCHNET_SocketSend(g_iot_socket, (uint8_t *)(buf + total_sent), &slen);
+        total_sent += (uint16_t)slen;
+        if (slen == 0 || ret != WCHNET_ERR_SUCCESS || ++retries > 10) {
+            PRINT("IOT: SocketSend PARTIAL ret=0x%02X sent=%u/%u retries=%d\n",
+                  ret, total_sent, len, retries);
+            return -1;
+        }
+    }
+    PRINT("IOT: SocketSend OK sent=%u\n", total_sent);
+    return 0;
 }
 
 /* 发送 MQTT CONNECT — 参考 net_srv.c mqtt_connect 实现 */