diff --git a/docs/wasm-inflate-panic.md b/docs/wasm-inflate-panic.md
index 48d167e..b1c2717 100644
--- a/docs/wasm-inflate-panic.md
+++ b/docs/wasm-inflate-panic.md
@@ -837,3 +837,39 @@ New debug knobs:
 - `?storehelpertci` re-enables the mixed store+load/helper fallback even under
   `?nostoretci` for A/B testing.
 - `?tlbguard=open` remains a negative probe; it did not catch the corruption.
+
+
+## E39-E45: false fixes and refined corruption proof
+
+Tested two root-fix candidates; both failed and were reverted:
+
+1. Persisting the qemu_ld/qemu_st computed TLB host address across restartable
+   blocks in `wasmContext`. Hypothesis: `BLOCK_PTR` survives re-entry but WASM
+   locals do not. Result: `?nostoretci` still crashed 3/3 at the original
+   `0x4201e210` signature.
+2. Reserving `TCG_AREG0` (`TCG_REG_R14`) from wasm register allocation.
+   Hypothesis: env global clobbering caused CPUArchState spills into the TLB
+   arrays. Result: `?nostoretci` still crashed 3/3 at the original signature.
+
+Additional trace refinements under `?ramrace=open`:
+
+- `mmu_lookup1` now prints `mmu_idx` plus compact/full TLB entry pointers.
+- `TLBTRACE` prints exact compact/full entry addresses.
+- `tlb_set_dirty1_locked` logs any dirty-bit C updates for the tracked page.
+
+Observed crash trace:
+
+```text
+TLBTRACE pc=0x4201dc96 mmu=3 index=56 entry=0x353b700 full=0x353bf00
+  read=0x3fcb8000 write=0x3fcb8000 addend=0xc19d4000
+  full_xlat=0xffffffffc03e4000
+FAULTTRACE mmu_lookup1 addr=0x3fcb80a5 mmu=3 index=56
+  tlb_addr=0x3fcb8200 flags=0x200 entry=0x353b700 full=0x353bf00
+  full_xlat=0x0 addend=0xc0348000
+```
+
+No `tlb_set_dirty1` logs appear before the corruption, so the C dirty/notdirty
+path is not writing these bad values. The exact same compact/full TLB entry in
+MMU mode 3 changes outside the instrumented C TLB mutation paths. Remaining
+suspect is generated WASM control/memory code in the `0x4201e20e` TB; interpreting
+that one TB still suppresses the crash.
diff --git a/third_party/qemu b/third_party/qemu
index 29cab65..ec4c6cc 160000
--- a/third_party/qemu
+++ b/third_party/qemu
@@ -1 +1 @@
-Subproject commit 29cab65aff64ba1399850431e7697f0b82920e97
+Subproject commit ec4c6cc95a80a6066085b9653cad99cc64ea45bf