diff --git a/core/box/hak_free_api.inc.h b/core/box/hak_free_api.inc.h
index 065c4884..537d8166 100644
--- a/core/box/hak_free_api.inc.h
+++ b/core/box/hak_free_api.inc.h
@@ -81,7 +81,8 @@ void hak_free_at(void* ptr, size_t size, hak_callsite_t site) {
         AllocHeader* hdr = (AllocHeader*)raw;
         if (hdr->magic != HAKMEM_MAGIC) {
             if (g_invalid_free_log) fprintf(stderr, "[hakmem] ERROR: Invalid magic 0x%X (expected 0x%X)\n", hdr->magic, HAKMEM_MAGIC);
-            if (g_invalid_free_mode) { goto done; } else { extern void __libc_free(void*); __libc_free(ptr); goto done; }
+            // CRITICAL FIX: Free raw (allocated address), not ptr (user pointer after header)
+            if (g_invalid_free_mode) { goto done; } else { free(raw); goto done; }
         }
         if (HAK_ENABLED_CACHE(HAKMEM_FEATURE_BIGCACHE) && hdr->class_bytes >= 2097152) {
             if (hak_bigcache_put(ptr, hdr->size, hdr->alloc_site)) goto done;