diff --git a/rp/src/memmap_rp.ld b/rp/src/memmap_rp.ld
index df1dd4f..bad82e0 100644
--- a/rp/src/memmap_rp.ld
+++ b/rp/src/memmap_rp.ld
@@ -295,8 +295,14 @@ SECTIONS
 
 
 
-    /* stack limit is poorly named, but historically is maximum heap ptr */
-    __StackLimit = ORIGIN(RAM) + LENGTH(RAM) + LENGTH(ROM_IN_RAM);
+    /* stack limit is poorly named, but historically is maximum heap ptr.
+     * Must NOT include ROM_IN_RAM: pico-sdk's _sbrk bounds the heap by
+     * this symbol, and letting it grow past ORIGIN(ROM_IN_RAM) hands the
+     * cartridge region (the code the m68k executes over the cart bus) to
+     * malloc -- FatFs LFN buffers then corrupt it at runtime and the ST
+     * crashes with bombs. Capped at the RAM/cart boundary so malloc
+     * fails cleanly instead. */
+    __StackLimit = ORIGIN(RAM) + LENGTH(RAM);
     __StackOneTop = ORIGIN(SCRATCH_X) + LENGTH(SCRATCH_X);
     __StackTop = ORIGIN(SCRATCH_Y) + LENGTH(SCRATCH_Y);
     __StackOneBottom = __StackOneTop - SIZEOF(.stack1_dummy);