diff --git a/RESEARCH.md b/RESEARCH.md
index 5c33b7b..682c12e 100644
--- a/RESEARCH.md
+++ b/RESEARCH.md
@@ -1161,3 +1161,31 @@ Reboot and report: (a) the text line(s) at the bottom (PROBE REVIVE
 MAPTBL LBIO FMT GEO — where does the sequence stop?), and (b) if an
 "ABORT! ESR=0x… ELR=0x… FAR=0x…" appears, transcribe the three hex
 values.
+
+## Round 31 — [ROOT CAUSE] page-table pool exhausted: mmu_map_region(coreboot table) → panic
+
+Round 30 result: "PROBE REVIVE" only — the hang is exactly at
+mmu_map_region(COREBOOT_TABLE_ADDR=0xffed9000, SZ_4K). No ABORT! text
+drawn ⇒ not a fault ⇒ a HANG. The only hang inside mmu_map_region:
+create_table() → panic("Insufficient RAM for page table") → hang().
+
+Why: get_page_table_size() budgets only for the STATIC memory map
+(count_ranges × 2 + 4 spare tables). Post-reloc dynamic mappings
+(the fb 0xFD536000/0x8ca000 → several L3 tables, then the 4K table
+region at 0xffed9000 → yet another L3) exhausted the pool. This
+retroactively explains the R25/R26 "<1 s reset to menu": with
+PANIC_HANG off, that same panic() → do_reset() → reset_cpu() →
+psci_system_reset() — the reset the user saw. Root cause found for
+the whole "dead/black/reset" saga since Round 12.
+
+### Fix (payload `34b9660f…`, flashed, cmp+vbutil OK)
+
+mt8183.c: board override of the __weak get_page_table_size() →
+0x40000 (64 tables), sized for the driver's dynamic mappings. This
+override is the intended extension mechanism and is upstreamable.
+
+### Expected
+
+PROBE REVIVE MAPTBL LBIO FMT GEO → screen clears → banner (white on
+black) + U-Boot prompt. If anything still fails, the ABORT!/panic
+text now lands on the panel.
diff --git a/krane-uboot-payload.bin b/krane-uboot-payload.bin
index 6ef2d2a..18821b9 100644
Binary files a/krane-uboot-payload.bin and b/krane-uboot-payload.bin differ
diff --git a/krane-uboot.bin b/krane-uboot.bin
index 05716f4..00b5eac 100644
Binary files a/krane-uboot.bin and b/krane-uboot.bin differ