diff --git a/core/box/ss_os_acquire_box.c b/core/box/ss_os_acquire_box.c
index 3ab93048..709c22ad 100644
--- a/core/box/ss_os_acquire_box.c
+++ b/core/box/ss_os_acquire_box.c
@@ -116,16 +116,22 @@ void* ss_os_acquire(uint8_t size_class, size_t ss_size, uintptr_t ss_mask, int p
     } else {
         log_superslab_oom_once(ss_size, ss_size, errno);
     }
-#else
-    (void)populate;  // Unused if MAP_ALIGNED_SUPER not available
 #endif
 
     // Fallback: allocate 2x size and align manually
+    // CRITICAL FIX (2025-12-05): Use MAP_POPULATE in fallback path
+    // BUG: Previous code marked populate as unused, ignoring prefault request
     size_t alloc_size = ss_size * 2;
     int flags = MAP_PRIVATE | MAP_ANONYMOUS;
 #ifdef MAP_POPULATE
     if (populate) {
         flags |= MAP_POPULATE;
+        static int dbg = 0;
+        if (dbg < 3) {
+            fprintf(stderr, "[SS_MMAP_DEBUG] populate=%d flags=0x%x (MAP_POPULATE=0x%x)\n",
+                    populate, flags, MAP_POPULATE);
+            dbg++;
+        }
     }
 #endif
     void* raw = mmap(NULL, alloc_size,
@@ -159,14 +165,38 @@ void* ss_os_acquire(uint8_t size_class, size_t ss_size, uintptr_t ss_mask, int p
     }
     size_t suffix_size = alloc_size - prefix_size - ss_size;
     if (suffix_size > 0) {
-        if (populate) {
-#ifdef MADV_DONTNEED
-            madvise((char*)ptr + ss_size, suffix_size, MADV_DONTNEED);
-#endif
-        } else {
-            munmap((char*)ptr + ss_size, suffix_size);
+        munmap((char*)ptr + ss_size, suffix_size);
+    }
+
+    // CRITICAL FIX (2025-12-05): Apply MADV_POPULATE_WRITE AFTER munmap trim
+    // Issue: munmap() appears to undo MAP_POPULATE state on Linux 6.8.0-87
+    // When mmap(4MB, MAP_POPULATE) is trimmed via munmap(prefix) + munmap(suffix),
+    // the remaining 2MB middle region loses its "pages populated" flag.
+    // Solution: Force re-population after trim using MADV_POPULATE_WRITE (Linux 5.14+)
+    // See: EXPLICIT_PREFAULT_IMPLEMENTATION_REPORT_20251205.md
+#ifdef MADV_POPULATE_WRITE
+    if (populate) {
+        int ret = madvise(ptr, ss_size, MADV_POPULATE_WRITE);
+        if (ret != 0) {
+            // Fallback for kernels that support MADV_POPULATE_WRITE but it fails
+            // Use explicit page-by-page touching with writes
+            volatile char* p = (volatile char*)ptr;
+            for (size_t i = 0; i < ss_size; i += 4096) {
+                p[i] = 0;
+            }
+            p[ss_size - 1] = 0;
         }
     }
+#else
+    if (populate) {
+        // Fallback for kernels < 5.14: explicit page touch
+        volatile char* p = (volatile char*)ptr;
+        for (size_t i = 0; i < ss_size; i += 4096) {
+            p[i] = 0;
+        }
+        p[ss_size - 1] = 0;
+    }
+#endif
 
     return ptr;
 }
diff --git a/core/superslab_cache.c b/core/superslab_cache.c
index 9df33863..36cce5e5 100644
--- a/core/superslab_cache.c
+++ b/core/superslab_cache.c
@@ -51,12 +51,9 @@ void* ss_os_acquire(uint8_t size_class, size_t ss_size, uintptr_t ss_mask, int p
     static int log_count = 0;
 
 #ifdef MAP_ALIGNED_SUPER
-    int map_flags = MAP_PRIVATE | MAP_ANONYMOUS | MAP_ALIGNED_SUPER;
-#ifdef MAP_POPULATE
-    if (populate) {
-        map_flags |= MAP_POPULATE;
-    }
-#endif
+    // MAP_POPULATE: Pre-fault pages to eliminate runtime page faults (60% of CPU overhead)
+    // Critical optimization: pre-fault during mmap (one-time cost) vs. runtime faults (every alloc)
+    int map_flags = MAP_PRIVATE | MAP_ANONYMOUS | MAP_ALIGNED_SUPER | MAP_POPULATE;
     ptr = mmap(NULL, ss_size,
                PROT_READ | PROT_WRITE,
                map_flags,
@@ -109,12 +106,19 @@ void* ss_os_acquire(uint8_t size_class, size_t ss_size, uintptr_t ss_mask, int p
         munmap((char*)ptr + ss_size, suffix_size);
     }
 
-    // populate が要求されている場合は、実際に使う SuperSlab 領域だけを事前 fault-in する。
-    if (populate) {
-#ifdef MADV_WILLNEED
-        madvise(ptr, ss_size, MADV_WILLNEED);
-#endif
+    // Pre-fault pages in fallback path (only after trim to actual SuperSlab size)
+    // This is critical: we MUST touch the pages after munmap() to establish valid mappings
+    // CRITICAL FIX (2025-12-05): Use MADV_POPULATE_WRITE for efficiency
+#ifdef MADV_POPULATE_WRITE
+    int ret = madvise(ptr, ss_size, MADV_POPULATE_WRITE);
+    if (ret != 0) {
+        // Fallback: explicit memset
+        memset(ptr, 0, ss_size);
     }
+#else
+    // Fallback for kernels < 5.14
+    memset(ptr, 0, ss_size);
+#endif
 
     ss_stats_os_alloc(size_class, ss_size);
     return ptr;