diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c
index 3416c86..90806db 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c
@@ -292,10 +292,10 @@ static int iot_make_topic(char *out, uint16_t out_len, const char *direction,
 
 /* 发送 MQTT 报文到 broker */
 static int iot_mqtt_send(const uint8_t *buf, uint16_t len) {
-    uint16_t slen = len;
-    PRINT("IOT: SocketSend sock=%d len=%d\n", g_iot_socket, len);
+    uint32_t slen = len;  /* 必须是 uint32_t: WCHNET_SocketSend 写 4 字节, uint16_t 会栈破坏致 hard fault */
+    PRINT("IOT: SocketSend sock=%d len=%lu\n", g_iot_socket, (unsigned long)slen);
     uint8_t ret = WCHNET_SocketSend(g_iot_socket, (uint8_t *)buf, &slen);
-    PRINT("IOT: SocketSend ret=0x%02X sent=%d\n", ret, slen);
+    PRINT("IOT: SocketSend ret=0x%02X sent=%lu\n", ret, (unsigned long)slen);
     return (ret == WCHNET_ERR_SUCCESS) ? 0 : -1;
 }