diff --git a/core/hakmem_tiny_free.inc b/core/hakmem_tiny_free.inc
index 01e89960..a0cf484b 100644
--- a/core/hakmem_tiny_free.inc
+++ b/core/hakmem_tiny_free.inc
@@ -7,6 +7,7 @@
 #include "box/free_publish_box.h"
 #include "box/tls_sll_box.h"  // Box TLS-SLL: C7-safe push/pop/splice
 #include "box/tiny_next_ptr_box.h"  // Box API: next pointer read/write
+#include "tiny_region_id.h"  // HEADER_MAGIC, HEADER_CLASS_MASK for freelist header restoration
 #include "mid_tcache.h"
 #include "front/tiny_heap_v2.h"
 // Phase 3d-B: TLS Cache Merge - Unified TLS SLL structure
@@ -70,6 +71,13 @@ static inline void tiny_drain_freelist_to_sll_once(SuperSlab* ss, int slab_idx,
 
         m->freelist = tiny_next_read(class_idx, p);  // Phase E1-CORRECT: Box API
 
+        // CRITICAL FIX: Restore header BEFORE pushing to TLS SLL
+        // Freelist blocks may have stale data at offset 0
+        // (same fix as in box_carve_and_push_with_freelist and tiny_superslab_alloc.inc.h)
+#if HAKMEM_TINY_HEADER_CLASSIDX
+        *(uint8_t*)p = HEADER_MAGIC | (class_idx & HEADER_CLASS_MASK);
+#endif
+
         // Use Box TLS-SLL API (C7-safe push)
         // Note: C7 already rejected at line 34, so this always succeeds
         uint32_t sll_capacity = 256;  // Conservative limit