diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md
index 5bfe6ab..acbd84a 100644
--- a/docs/HUYA_HDID_ALGORITHM_GEN.md
+++ b/docs/HUYA_HDID_ALGORITHM_GEN.md
@@ -1221,3 +1221,9 @@ dfpReport:     tReq = [10B 魔数 57 18 82 cf 66 4b b3 94 01 ee][3988B 加密采
 1. **直调 b87_@0x25c98** (JNI 封送: vaList/int-handle) — 喂真实捕获 blob → 输出 SparseArray = 证据事件 = 明文!
 2. JNI_OnLoad x0: 追踪 onLoad 内部分配链 (0x12b6c 原子函数的调用者)
 3. ga 侧 JNI 表 (turingga.so 同法解剖) → a209202_ 族入口
+
+### R21-补充: b87_ harness 直调结果 (2026-08-29)
+- addLocalObject 句柄封送 (int 句柄作 jobject) — **调用执行成功** (不再 Unsupported arg)
+- 三种输入 (全POST/cipher-only/magic+cipher) × int{0,1} = 全部确定性 **ret=-1**
+- 判定: jobject 封送通; -1 = turing 全局初始化态缺失 (config/dat 未载入) 或 SparseArray 内容格式不符
+- 下一步: (a) onLoad 初始化链修复后直调 (x0 原子问题先解), (b) 或喂 SparseArray 事件内容探格式
diff --git a/tools/unidbg/hydev/src/hydev/TuringProbe.java b/tools/unidbg/hydev/src/hydev/TuringProbe.java
index c61aec2..5edb4fc 100644
--- a/tools/unidbg/hydev/src/hydev/TuringProbe.java
+++ b/tools/unidbg/hydev/src/hydev/TuringProbe.java
@@ -123,11 +123,16 @@ public class TuringProbe {
             DvmObject<?> sa = vm.resolveClass("android/util/SparseArray").newObject(null);
             DvmObject<?> dba = vm.resolveClass("[B").newObject(blob);
             DvmObject<?> map = vm.resolveClass("java/util/HashMap").newObject(null);
-            // 直调 impl: module.base + 0x25c98; 参数: env, null, sa, dba, map, 1
+            // 直调 impl: module.base + 0x25c98; 参数: env, null, 局部引用句柄(int), ..., 1
             long fn = m.base + 0x25c98;
-            System.out.println("[TP] calling b87_ @ " + Long.toHexString(fn) + " blob=" + blob.length + "B");
-            Number ret = m.callFunction(emulator, fn, vm.getJavaVM(), null, sa, dba, map, 1);
-            System.out.println("[TP] b87_ ret=" + ret);
+            int hsa = vm.addLocalObject(sa);
+            int hba = vm.addLocalObject(dba);
+            int hmap = vm.addLocalObject(map);
+            System.out.println("[TP] calling b87_ @ " + Long.toHexString(fn) + " blob=" + blob.length
+                    + " refs hsa=" + hsa + " hba=" + hba + " hmap=" + hmap);
+            int iv = Integer.parseInt(System.getenv().getOrDefault("TP_INT", "1"));
+            Number ret = m.callFunction(emulator, fn, vm.getJavaVM(), null, hsa, hba, hmap, iv);
+            System.out.println("[TP] b87_ ret=" + ret + " int=" + iv + " blob=" + blobPath);
         } catch (Throwable t) {
             System.out.println("[TP] callEnc EXC " + t);
             t.printStackTrace(System.out);