diff --git a/docs/wasm-inflate-panic.md b/docs/wasm-inflate-panic.md
index a73a506..e2c6cec 100644
--- a/docs/wasm-inflate-panic.md
+++ b/docs/wasm-inflate-panic.md
@@ -114,6 +114,19 @@ isolation, which points away from the direct emit and toward the store path's
 surrounding block/rewind/helper scaffolding in `tcg_wasm_out_qemu_st`, or an
 interaction with a co-located op.
 
+### E2 — crash is icount-independent; loads-TCI also masks it (inconclusive on op)
+- Removed the store flag and ran at the new `noicount` default: **same crash**
+  (`Invalid read at 0x3FCB80A5`, drifts, `MEPC 0x4201e210`). So icount timing
+  is not the trigger.
+- Moved the flag to `tcg_out_qemu_ld` (loads TCI, stores compiled): **passed**
+  (33s). Not decisive — load-containing TBs are a superset of store-containing
+  TBs, so forcing loads to TCI drops nearly every TB (including all store TBs)
+  to the interpreter. It masks the bug the same way store-TCI does.
+- **Takeaway:** whole-TB TCI cannot isolate the offending op. Precise
+  localization needs per-op TCI infrastructure (backend is whole-TB) or reading
+  the generated wasm for one miscompiled TB. Large task; reader already works at
+  ~31s with the store flag, so this is headroom, not a blocker.
+
 ### Next options
 1. **Ship E1 as a guarded workaround** — reader works now; measure real
    navigation/page-turn perf before judging it unacceptable.
diff --git a/third_party/qemu b/third_party/qemu
index 7cab93e..b3ca9f1 160000
--- a/third_party/qemu
+++ b/third_party/qemu
@@ -1 +1 @@
-Subproject commit 7cab93ede7ade918756adb014464507ec9241169
+Subproject commit b3ca9f1eb60fce26983ae365945cf7d17213af90