diff --git a/qemu/saimaa.c b/qemu/saimaa.c
index e2f1f1c..1e77af7 100644
--- a/qemu/saimaa.c
+++ b/qemu/saimaa.c
@@ -808,6 +808,15 @@ static void saimaa_machine_init(MachineState *machine)
                     cpu_physical_memory_write(a, &fill, 4);
                 }
             }
+            /* IMEM poison [0x8600000,0x8600F00): drift-sink trap (UDF in
+             * both modes). IMEM stack [0x8600F00,0x8610000) intact. */
+            {
+                uint32_t p = 0xFFFFFFFF;
+                uint32_t a;
+                for (a = 0x08600000; a < 0x08600F00; a += 4) {
+                    cpu_physical_memory_write(a, &p, 4);
+                }
+            }
             /* pop-site slots -> stublets (sp values from cpu traces) */
             v = 0x802f65d; /* S1 pop10 @fef0: resume sbl_main */
             cpu_physical_memory_write(0x085FFF14, &v, 4);
diff --git a/tools/sbl_uni.py b/tools/sbl_uni.py
index 3a7c6d2..2a3fc00 100644
--- a/tools/sbl_uni.py
+++ b/tools/sbl_uni.py
@@ -436,6 +436,11 @@ def main():
         "60474af20007c0f2730747f2797cc0f6000c6047"))
     # stack zone fill (STUBV odd)
     mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
+    # IMEM poison [0x8600000,0x8600F00): drift-sink trap. Fill/IMEM-zero
+    # sleds (fall-through ldr/movs/andeq) drift silently to IMEM-top
+    # fault; poison faults LOUDLY at drift-entry (UDF in both modes).
+    # IMEM stack [0x8600F00,0x8610000) left intact.
+    mu.mem_write(0x08600000, b"\xff\xff\xff\xff" * (0xF00 // 4))
     # pop-site slots (sp values from traces)
     for a, v in [(0x085FFF14, 0x802f65d), (0x085FFF1C, 0x802f665),
                  (0x085FFF44, 0x8013ba5), (0x085FFF5C, 0x802f681),