diff --git a/qemu/saimaa.c b/qemu/saimaa.c
index 9e61dac..03e04a0 100644
--- a/qemu/saimaa.c
+++ b/qemu/saimaa.c
@@ -167,7 +167,29 @@ struct SaimaaUartState {
 static int saimaa_vec_n;
 static uint64_t saimaa_vec_read(void *opaque, hwaddr off, unsigned size)
 {
-    if (saimaa_vec_n < 400) {
+    /* Maze blob mirrored at [0,18) for THUMB fetches: null-jump fetches
+     * (bx r0=0, pop 0, ldr pc,=0) execute the maze and return via lr —
+     * uni parity (hook_null -> STUB). ARM-mode fetches (real exception
+     * entry) keep BKPT vectors below. Data probes elsewhere read 0. */
+    static const uint8_t maze[18] = {
+        0x00, 0x20, 0x4f, 0xea, 0x1e, 0x6c, 0xbc, 0xf1,
+        0x08, 0x0f, 0x00, 0xd1, 0x70, 0x47, 0x72, 0xb6,
+        0xfd, 0xe7,
+    };
+    {
+        ARMCPU *cpu = ARM_CPU(current_cpu);
+        if (cpu && cpu->env.thumb && off < sizeof(maze)) {
+            uint64_t v = 0;
+            unsigned i, n = size;
+            if (off + n > sizeof(maze)) {
+                n = sizeof(maze) - off;
+            }
+            for (i = 0; i < n; i++) {
+                v |= (uint64_t)maze[off + i] << (8 * i);
+            }
+            return v;
+        }
+    }    if (saimaa_vec_n < 400) {
         ARMCPU *cpu = ARM_CPU(current_cpu);
         uint64_t pc = cpu ? cpu->env.regs[15] : 0;
         int th = cpu ? cpu->env.thumb : 0;