diff --git a/docs/wasm-inflate-panic.md b/docs/wasm-inflate-panic.md
index b1c2717..892234c 100644
--- a/docs/wasm-inflate-panic.md
+++ b/docs/wasm-inflate-panic.md
@@ -873,3 +873,62 @@ path is not writing these bad values. The exact same compact/full TLB entry in
 MMU mode 3 changes outside the instrumented C TLB mutation paths. Remaining
 suspect is generated WASM control/memory code in the `0x4201e20e` TB; interpreting
 that one TB still suppresses the crash.
+
+
+## E46-E72: narrowed from mixed stores to aliased qemu_ld
+
+The previous mixed-store fallback was still too broad. Further probes narrowed
+the failing compiled code class:
+
+- `?rettci` (all indirect-return TBs TCI) still crashed 3/3.
+- TCG op dumps for the key TB at `0x4201e20e` showed the relevant translated
+  operations were not the source-level epilogue disassembly. The normal TB
+  contains qemu memory ops; a count-limited dump showed the minimal failing
+  shape.
+- `?singlestpc=0x4201e20e-0x4201e210` passed 3/3.
+- `count=2` for that PC crashed immediately. Its TCG ops were:
+
+```text
+add_i32 x14/a4,x14/a4,x15/a5
+qemu_ld_a32_i32 x14/a4,x14/a4,noat+al+ub,3
+```
+
+That made the minimal failing compiled unit a qemu_ld where destination and
+address register are the same TCG register.
+
+False leads tested and reverted:
+
+- pointer-width loads for `CPUTLBDescFast.mask/table`;
+- slow-flag checks in the wasm TLB fast path;
+- bypassing the direct TLB fast path with helpers;
+- making qemu_ld a single-block helper/direct wrapper;
+- copying the aliased qemu_ld address through `TCG_REG_TMP` before emission.
+
+The decisive probe was to interpret only qemu_ld TBs where `args[0] == args[1]`
+(destination register aliases address register). With the old mixed-store
+fallback disabled via `?nostoretci`, this passed 5/5:
+
+```text
+aliasonly nostoretci run 1 -> PASS open example.txt took 34.8s
+aliasonly nostoretci run 2 -> PASS open example.txt took 39.1s
+aliasonly nostoretci run 3 -> PASS open example.txt took 37.9s
+aliasonly nostoretci run 4 -> PASS open example.txt took 37.1s
+aliasonly nostoretci run 5 -> PASS open example.txt took 36.6s
+```
+
+After replacing the default mixed-store fallback with the narrower aliased-load
+fallback, both default and `?nostoretci` passed 3/3:
+
+```text
+default run 1 -> PASS open example.txt took 37.1s
+default run 2 -> PASS open example.txt took 38.9s
+default run 3 -> PASS open example.txt took 37.1s
+nostoretci run 1 -> PASS open example.txt took 37.1s
+nostoretci run 2 -> PASS open example.txt took 37.6s
+nostoretci run 3 -> PASS open example.txt took 44.2s
+```
+
+Current status: the production fallback is now much narrower. Mixed store+load
+TBs compile by default again. The remaining backend bug is specifically in
+compiled qemu_ld when the destination TCG register aliases the address TCG
+register; interpreting those TBs avoids the original TLB corruption.
diff --git a/third_party/qemu b/third_party/qemu
index ec4c6cc..c1fc905 160000
--- a/third_party/qemu
+++ b/third_party/qemu
@@ -1 +1 @@
-Subproject commit ec4c6cc95a80a6066085b9653cad99cc64ea45bf
+Subproject commit c1fc905cf2822d2c8273bbf5eb74991979e902aa