diff --git a/qemu/saimaa.c b/qemu/saimaa.c
index bbfa1a6..e54a41d 100644
--- a/qemu/saimaa.c
+++ b/qemu/saimaa.c
@@ -775,10 +775,10 @@ static void saimaa_machine_init(MachineState *machine)
                 v = 0x08024000;
                 cpu_physical_memory_write(0x080164F0, &v, 4);
             }
-            /* HW-ready bits (b25/b26): [0x073A100] bits 0,1,2 (SBL
-             * read-only polls: bit2 poll#1, bit1 poll#2, bit0 gate). */
+            /* HW-ready bits (b25/b26/b39): [0x073A100] bits 0,1,2 (SBL
+             * read-only polls) + bit10 (ubfx loop exit at 0x80079BA). */
             {
-                uint32_t v = 0x00000007;
+                uint32_t v = 0x00000407;
                 cpu_physical_memory_write(0x073A100, &v, 4);
             }
             /* PBL world-switch Thumb-stub (b24, 4B @0x00221EF8):
diff --git a/tools/sbl_uni.py b/tools/sbl_uni.py
index b760a38..b6da9ac 100644
--- a/tools/sbl_uni.py
+++ b/tools/sbl_uni.py
@@ -465,10 +465,12 @@ def main():
     W32(0x08024000, 0x08024000)
     W32(0x08024014, 0x00000002)
     W32(0x080164F0, 0x08024000)
-    # HW-ready bit fabrication (b25): [0x073A100] bits 0,1,2 = peripheral
+    # HW-ready bit fabrication (b25/b39): [0x073A100] bits 0,1,2 = peripheral
     # status done-bits (poll#1 checks bit2 (lsls#29), poll#2 bit1 (lsls#30),
-    # post-poll gate bit0 (lsls#31)). SBL only reads it, never writes.
-    W32(0x073A100, 0x00000007)
+    # post-poll gate bit0 (lsls#31)); bit10 set so ubfx r4,[#0xa,#4] at
+    # 0x80079BA yields 1 (loop exit, HW sets it when unit ready).
+    # SBL only reads it, never writes.
+    W32(0x073A100, 0x00000407)
     # PBL world-switch Thumb-stub (b24): the ARM trampoline at 0x221EF8
     # is entered in Thumb (mode confusion at dispatch); real ARM would
     # save regs/CPS to MON and call TZ (not loaded yet). Stub returns 0