diff --git a/qemu/saimaa.c b/qemu/saimaa.c
index 363a250..cab8f0b 100644
--- a/qemu/saimaa.c
+++ b/qemu/saimaa.c
@@ -23,6 +23,8 @@
 
 /* Real MSM8909 map (subset) */
 #define SAIMAA_UEFI_BASE     0x10000000
+#define SAIMAA_UEFITAB_BASE  0x13000000
+#define SAIMAA_UEFITAB_SIZE  0x00004000
 #define SAIMAA_UEFI_SIZE     0x04000000
 #define SAIMAA_RPM_BASE      0x00400000
 /* Ends before peripheral window 0x07800000 (SDC/USB/UART live there;
@@ -330,6 +332,7 @@ static void saimaa_machine_init(MachineState *machine)
     /* RAM map */
     const struct { const char *n; hwaddr b; hwaddr s; } rams[] = {
         { "saimaa.uefi", SAIMAA_UEFI_BASE, SAIMAA_UEFI_SIZE },
+        { "saimaa.uefitab", SAIMAA_UEFITAB_BASE, SAIMAA_UEFITAB_SIZE },
         { "saimaa.rpm", SAIMAA_RPM_BASE, SAIMAA_RPM_SIZE },
         { "saimaa.ocimem", SAIMAA_OCIMEM_BASE, SAIMAA_OCIMEM_SIZE },
         { "saimaa.ddrlow", SAIMAA_DDRLOW_BASE, SAIMAA_DDRLOW_SIZE },
diff --git a/tools/sbl_uni.py b/tools/sbl_uni.py
index 95f064b..9497368 100644
--- a/tools/sbl_uni.py
+++ b/tools/sbl_uni.py
@@ -45,7 +45,7 @@ RAMS = [
     (0x07800000, 0x000AF000),   # leak-sink HI (S12 frame march;
     (0x078B0000, 0x00750000),   #  gap minus UARTDM page, HW-rsvd)
     (0x078AF000, 0x00001000),   # UARTDM page
-    (0x13000000, 0x00002000),   # UEFI tables (already above, keep)
+    (0x13000000, 0x00004000),   # UEFI tables (ext: walker reads past 0x2000)
 ]
 UART_TF = 0x078AF070
 UART_SR = 0x078AF008