diff --git a/patch_v2/meow_svcd/meow_svcd b/patch_v2/meow_svcd/meow_svcd
index 3a7575f..da7b69c 100755
Binary files a/patch_v2/meow_svcd/meow_svcd and b/patch_v2/meow_svcd/meow_svcd differ
diff --git a/patch_v2/meow_svcd/meow_svcd.c b/patch_v2/meow_svcd/meow_svcd.c
index 5ce3ecd..bf3e5aa 100644
--- a/patch_v2/meow_svcd/meow_svcd.c
+++ b/patch_v2/meow_svcd/meow_svcd.c
@@ -297,6 +297,17 @@ static void apply_field(svc_t *s, const char *k, const char *v)
     /* 未知键忽略（前向兼容） */
 }
 
+/* 重建 s->argv[]：argv[0]=exec、argv[i+1]=argbuf[i]、末尾 NULL。
+ * s->argv 是指针数组；load_conf 里它指向 s 自身的 exec/argbuf（栈局部 tmp 亦成立），
+ * 但 scan_and_reconcile 用 *s=tmp 整体拷贝时只复制指针值，仍指向已销毁的 tmp 栈帧。
+ * 故赋值后必须重定位到 s 自己的 exec/argbuf，否则 execv 传出的 argv[0]/cmdline 读到脏值。 */
+static void svc_rebuild_argv(svc_t *s)
+{
+    s->argv[0] = s->exec;
+    for (int i = 0; i < s->argc; i++) s->argv[i + 1] = s->argbuf[i];
+    s->argv[s->argc + 1] = NULL;
+}
+
 /* 解析单个 .conf 到 svc（name=basename）。成功返回 0。 */
 static int load_conf(const char *path, const char *name, svc_t *s)
 {
@@ -339,10 +350,7 @@ static int load_conf(const char *path, const char *name, svc_t *s)
         strcmp(s->trigger, "wifi-up"))
         safe_strcpy(s->trigger, sizeof s->trigger, "card-mount");
 
-    /* argv[0]=exec；随后 args */
-    s->argv[0] = s->exec;
-    for (int i = 0; i < s->argc; i++) s->argv[i + 1] = s->argbuf[i];
-    s->argv[s->argc + 1] = NULL;
+    svc_rebuild_argv(s);
 
     return 0;
 }
@@ -709,6 +717,7 @@ static void scan_and_reconcile(void)
         int keep_user  = s->user_stopped;
         int keep_state = s->state;
         *s = tmp;
+        svc_rebuild_argv(s);            /* 重定位 argv[] 到 s 自身成员，防悬垂指针 */
         s->restart_count = keep_count;
         s->last_exit_status = keep_exit;
         s->has_exit = keep_has;