diff --git a/docs/sbl-bringup.md b/docs/sbl-bringup.md
index 9fd508c..0b45369 100644
--- a/docs/sbl-bringup.md
+++ b/docs/sbl-bringup.md
@@ -173,4 +173,4 @@
   (2B, в success-путь).
 - Урок: полный IMEM-poison ломает IMEM-стек (счётчики читают
   0xFFFFFFFF вместо свежих нулей → underflow → wild-pop). Только
-  tripwire 16B на входе дрейфа `[0x8600000,0x8600010)`.
+  tripwire 4B на входе дрейфа `[0x8600000,0x8600004)`.
diff --git a/qemu/saimaa.c b/qemu/saimaa.c
index 66673ed..a3813ad 100644
--- a/qemu/saimaa.c
+++ b/qemu/saimaa.c
@@ -822,14 +822,11 @@ static void saimaa_machine_init(MachineState *machine)
                     cpu_physical_memory_write(a, &fill, 4);
                 }
             }
-            /* IMEM tripwire [0x8600000,0x8600010): drift-sink trap.
-             * Rest of IMEM stays zeros (SBL stack reads data there). */
+            /* IMEM tripwire [0x8600000,0x8600004): drift-sink trap.
+             * Must stay 4B (wider poison corrupts IMEM-stack reads). */
             {
                 uint32_t p = 0xFFFFFFFF;
-                uint32_t a;
-                for (a = 0x08600000; a < 0x08600010; a += 4) {
-                    cpu_physical_memory_write(a, &p, 4);
-                }
+                cpu_physical_memory_write(0x08600000, &p, 4);
             }
             /* pop-site slots -> stublets (sp values from cpu traces) */
             v = 0x802f65d; /* S1 pop10 @fef0: resume sbl_main */
diff --git a/tools/sbl_uni.py b/tools/sbl_uni.py
index 9343f31..e636fa8 100644
--- a/tools/sbl_uni.py
+++ b/tools/sbl_uni.py
@@ -474,12 +474,11 @@ def main():
         "60474af20007c0f2730747f2797cc0f6000c6047"))
     # stack zone fill (STUBV odd)
     mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
-    # IMEM tripwire [0x8600000,0x8600010): drift-sink trap (UDF).
+    # IMEM tripwire [0x8600000,0x8600004): drift-sink trap (UDF).
     # Fill-drift falls through here sequentially; faults LOUDLY at
-    # entry instead of sledding silently to IMEM-top. Rest of IMEM
-    # stays zeros (SBL IMEM-stack reads data there; full poison
-    # corrupts counters (0xFFFFFFFF vs fresh 0)!).
-    mu.mem_write(0x08600000, b"\xff\xff\xff\xff" * 4)
+    # entry. Must stay 4B: wider poison corrupts IMEM-stack reads
+    # (SBL frames live at 0x860000C+, counters underflow on 0xFF!).
+    mu.mem_write(0x08600000, b"\xff\xff\xff\xff")
     # pop-site slots (sp values from traces)
     for a, v in [(0x085FFF14, 0x802f65d), (0x085FFF1C, 0x802f665),
                  (0x085FFF44, 0x8013ba5), (0x085FFF5C, 0x802f681),