diff --git a/qemu/run-sbl.sh b/qemu/run-sbl.sh
index 303e909..0b8b910 100755
--- a/qemu/run-sbl.sh
+++ b/qemu/run-sbl.sh
@@ -5,7 +5,7 @@
 set -e
 cd "$(dirname "$0")/.."
 QEMU=~/qemu-src/qemu-8.2.2/build/qemu-system-arm
-B=${1:-b47}
+B=${1:-b48}
 IMG=fw/img/emmc-real.img
 if [ ! -f "$IMG" ]; then
   echo "no $IMG — сначала: python3 tools/ffu_extract.py fw/dl/RM1127_059X5R5_orig.ffu --emmc-user fw/img/user-real.bin"
diff --git a/qemu/saimaa.c b/qemu/saimaa.c
index b9eb302..e4cafa4 100644
--- a/qemu/saimaa.c
+++ b/qemu/saimaa.c
@@ -789,32 +789,14 @@ static void saimaa_machine_init(MachineState *machine)
                 uint32_t v = 0x47702000;
                 cpu_physical_memory_write(0x00221EF8, &v, 4);
             }
-             /* S12-stub (b27/b43, 132B @0x08006964, ARM): blx-to-padding
-             * becomes smart dispatcher: ldr ip,[sp,#4] (=pushed lr);
-             * keep (odd code): appended tail restores r7, ACKs bit1,
-             * ([literal2 0x073A100]) and bx lr to wrapper tail (paired
-             * pop, balanced). default: shared restore/ACK then bx ip to
-             * poll resumption (no tail visit, no creep).
+             /* S12-stub (b27/b43/b48, 12B @0x08006964, Thumb keep-only)
+             * ldr r7,[pc] (=0x73A000) + bx lr. R7-restore load-bearing;
+             * ACK/classify dropped as proven noops.
              * PBL would place the real ARM helper here. */
             {
                 static const uint8_t s12[] = {
-                    0x04, 0xc0, 0x9d, 0xe5, 0x8d, 0x3b, 0x06, 0xe3,
-                    0x00, 0x38, 0x40, 0xe3, 0x03, 0x00, 0x5c, 0xe1,
-                    0x09, 0x00, 0x00, 0x0a, 0x01, 0x00, 0x1c, 0xe3,
-                    0x07, 0x00, 0x00, 0x0a, 0x2c, 0x3c, 0xa0, 0xe1,
-                    0x08, 0x00, 0x53, 0xe3, 0x00, 0x00, 0x00, 0x1a,
-                    0x0d, 0x00, 0x00, 0xea, 0x2c, 0x3e, 0xa0, 0xe1,
-                    0x08, 0x00, 0x53, 0xe3, 0x00, 0x00, 0x00, 0x1a,
-                    0x09, 0x00, 0x00, 0xea, 0x79, 0xc7, 0x07, 0xe3,
-                    0x00, 0xc8, 0x40, 0xe3, 0x00, 0x70, 0x0a, 0xe3,
-                    0x73, 0x70, 0x40, 0xe3, 0x0c, 0x30, 0x9f, 0xe5,
-                    0x00, 0x20, 0x93, 0xe5, 0x02, 0x20, 0x82, 0xe3,
-                    0x00, 0x20, 0x83, 0xe5, 0x1c, 0xff, 0x2f, 0xe1,
-                    0x00, 0xa1, 0x73, 0x00, 0x00, 0x70, 0x0a, 0xe3,
-                    0x73, 0x70, 0x40, 0xe3, 0x0c, 0x30, 0x9f, 0xe5,
-                    0x00, 0x20, 0x93, 0xe5, 0x02, 0x20, 0x82, 0xe3,
-                    0x00, 0x20, 0x83, 0xe5, 0x1e, 0xff, 0x2f, 0xe1,
-                    0x00, 0xa1, 0x73, 0x00,};
+                    0xdf, 0xf8, 0x04, 0x70, 0x70, 0x47, 0x00, 0x00,
+                    0x00, 0xa0, 0x73, 0x00,};
                 size_t k;
                 for (k = 0; k < sizeof(s12); k += 4) {
                     uint32_t word = 0;
diff --git a/tools/sbl_uni.py b/tools/sbl_uni.py
index 0b15350..1fdaa72 100644
--- a/tools/sbl_uni.py
+++ b/tools/sbl_uni.py
@@ -630,21 +630,13 @@ def main():
     # to the dispatcher via stale lr (TZ bringup deferred).
     # NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF).
     mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
-    # S12-stub (b27/b43, 132B @0x08006964, ARM): blx-to-padding
-    # smart dispatcher (PBL contract): ldr ip,[sp,#4] (=pushed lr).
-    # keep (odd code): appended tail restores r7, ACKs bit1, bx lr to
-    # wrapper tail (paired pop, balanced). default (STUBV/even/non-code,
-    # i.e. unpaired entry): shared restore/ACK then bx ip to poll
-    # resumption 0x8007779 (no tail visit, no pop, no creep). PBL would
-    # place the real ARM helper here.
+    # S12-stub (b27/b43/b48, 12B @0x08006964, Thumb keep-only):
+    # ldr r7,[pc] (=0x73A000) + bx lr. R7-restore is load-bearing
+    # (firmware clobbers r7); ACK dropped (sticky bit, proven noop);
+    # classify/divert dropped (default never fired: identical tpop
+    # with/without it). PBL would place the real ARM helper here.
     mu.mem_write(0x08006964, bytes.fromhex(
-        "04c09de58d3b06e3003840e303005ce10900000a"
-        "01001ce30700000a2c3ca0e1080053e30000001a"
-        "0d0000ea2c3ea0e1080053e30000001a090000ea"
-        "79c707e300c840e300700ae3737040e30c309fe5"
-        "002093e5022082e3002083e51cff2fe100a17300"
-        "00700ae3737040e30c309fe5002093e5022082e3"
-        "002083e51eff2fe100a17300"))
+        "dff804707047000000a07300"))
     # S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip.
     # ip==STUBV (fill/maze, never a legit return) => default;
     # ip odd + top 8 (code) => add sp,#8 (pop the helper frame B66