diff --git a/core/front/malloc_tiny_fast.h b/core/front/malloc_tiny_fast.h
index cae32284..b3c0deae 100644
--- a/core/front/malloc_tiny_fast.h
+++ b/core/front/malloc_tiny_fast.h
@@ -430,6 +430,24 @@ static inline int free_tiny_fast_hot(void* ptr) {
         return 1;
     }
 
+    // Phase FREE-TINY-FAST-DUALHOT-1: C0-C3 direct path (48% of calls)
+    // Skip expensive policy snapshot and route determination, direct to legacy fallback.
+    // Safety: Check Larson mode (cross-thread free handling requires full validation path)
+    {
+        static __thread int g_larson_fix = -1;
+        if (__builtin_expect(g_larson_fix == -1, 0)) {
+            const char* e = getenv("HAKMEM_TINY_LARSON_FIX");
+            g_larson_fix = (e && *e && *e != '0') ? 1 : 0;
+        }
+
+        if (__builtin_expect(class_idx <= 3 && !g_larson_fix, 1)) {
+            // C0-C3 + Larson mode OFF → Direct to legacy (no policy snapshot overhead)
+            tiny_legacy_fallback_free_base(base, class_idx);
+            FREE_TINY_FAST_HOTCOLD_STAT_INC(hot_hit);
+            return 1;
+        }
+    }
+
     // Phase POLICY-FAST-PATH-V2: Skip policy snapshot for known-legacy classes
     if (free_policy_fast_v2_can_skip((uint8_t)class_idx)) {
         FREE_PATH_STAT_INC(policy_fast_v2_skip);