diff --git a/tools/sbl_uni.py b/tools/sbl_uni.py
index 7b9897e..30232fe 100644
--- a/tools/sbl_uni.py
+++ b/tools/sbl_uni.py
@@ -467,6 +467,8 @@ def main():
     # immune to [0]-writes that clobber a static maze copy
     from unicorn.arm_const import UC_ARM_REG_PC as _PC
     _nulllog = []
+    _nstale = [0]
+    _nsrc = {}
     _halt_on_null = "--haltonnull" in sys.argv
 
     def hook_null(mu, addr, size, data):
@@ -481,7 +483,22 @@ def main():
             _nulllog.append((count[0], r, lr, sp))
         if _halt_on_null and len(_nulllog) == 1:
             return False
-        mu.reg_write(_PC, STUB + 1)
+        # fresh blx (lr just set by link) -> maze; stale bx/pop (lr garbage)
+        # -> poll-resumption (kills maze->sbl_mid hijack, PBL contract).
+        try:
+            _hp = hist[-2][0] if len(hist) >= 2 else -1
+            _ph = struct.unpack('<H', mu.mem_read(_hp & ~1, 2))[0] if _hp >= 0 else 0
+        except Exception:
+            _ph = 0
+        if (_ph & 0xFF80) == 0x4780:
+            mu.reg_write(_PC, STUB + 1)
+        else:
+            _nstale[0] += 1
+            _hp2 = hist[-2][0] if len(hist) >= 2 else -1
+            _hp1 = hist[-1][0] if len(hist) >= 1 else -1
+            _nsrc[(_hp2, _hp1)] = _nsrc.get((_hp2, _hp1), 0) + 1
+            mu.reg_write(_LR, 0x8007779)
+            mu.reg_write(_PC, STUB + 1)
 
     mu.hook_add(UC_HOOK_CODE, hook_null, begin=0x0, end=0xFFF)
     if "--watchcode" in sys.argv:
@@ -807,6 +824,8 @@ def main():
         for n, pc, sp in _splog:
             print(f"  insn#{n} {pc:#x} sp={sp:#x}")
     if _nulllog:
+        print('null-stale-diverts:', _nstale[0])
+        print('null-src-top:', sorted(_nsrc.items(), key=lambda kv: -kv[1])[:10])
         print(f"null-entries: {len(_nulllog)}")
         for n, r, lr, sp in _nulllog:
             print(f"  insn#{n} r0-r3={[hex(x) for x in r]} lr={lr:#x} sp={sp:#x}")