diff --git a/Makefile b/Makefile
index 42f6ece9..7ba83eb6 100644
--- a/Makefile
+++ b/Makefile
@@ -467,6 +467,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_dotbase_arr_run \
 	  $(BIN)/test_dotbase_addr_slice_run \
 	  $(BIN)/test_slicecopy_assign_run \
+	  $(BIN)/test_globalslice_arg_run \
 	  $(BIN)/test_structlit_arrfield_run \
 	  $(BIN)/test_defdim_struct_run \
 	  $(BIN)/test_arraytoslice_run \
@@ -2135,6 +2136,11 @@ $(BIN)/test_slicecopy_assign_run: test/wcc/952_slicecopy_assign_run.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_globalslice_arg_run: test/wcc/953_globalslice_arg_run.c \
+		$(BIN)/ww $(BIN)/w6c $(BIN)/w6c_ww $(BIN)/w6a $(BIN)/w6l \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_structlit_arrfield_run: test/wcc/949_structlit_arrfield_run.c \
 		$(BIN)/ww $(BIN)/w6c $(BIN)/w6c_ww $(BIN)/w6a $(BIN)/w6l \
 		$(LIB)/libwwrt.a | $(BIN)
diff --git a/cmd/w6c/cgen.c b/cmd/w6c/cgen.c
index 1c8ec280..581158ca 100644
--- a/cmd/w6c/cgen.c
+++ b/cmd/w6c/cgen.c
@@ -9081,6 +9081,21 @@ cgexpr(Cg *c, Node *n, Local *locals)
 				continue;
 			if (!widen[i] && node_isslice(args[i]) && args[i]->kind == N_IDENT) {
 				int off = localfind(locals, args[i]->str);
+				/* #148: localfind→0 for a module global, but the
+				 * header lives at name(SB), not BP+0. Mirror the
+				 * N_SLICE arm's isglobal dispatch below: LEAQ the
+				 * symbol into a base reg, push 16/8/0 off it. */
+				if (off == 0 && let_islet(args[i]->str)) {
+					ins2(c, A_LEAQ, masym(c, args[i]->str),
+					    areg(D_BX));
+					ins2(c, A_MOVQ, amem(D_BX, 16), areg(D_AX));
+					ins1(c, A_PUSHQ, areg(D_AX));
+					ins2(c, A_MOVQ, amem(D_BX, 8), areg(D_AX));
+					ins1(c, A_PUSHQ, areg(D_AX));
+					ins2(c, A_MOVQ, amem(D_BX, 0), areg(D_AX));
+					ins1(c, A_PUSHQ, areg(D_AX));
+					continue;
+				}
 				/* push cap, len, ptr (top) so pops give ptr,len,cap */
 				ins2(c, A_MOVQ, amem(D_BP, off + 16), areg(D_AX));
 				ins1(c, A_PUSHQ, areg(D_AX));
diff --git a/test/wcc/953_globalslice_arg_run.c b/test/wcc/953_globalslice_arg_run.c
new file mode 100644
index 00000000..a6183195
--- /dev/null
+++ b/test/wcc/953_globalslice_arg_run.c
@@ -0,0 +1,169 @@
+/*
+ * 953_globalslice_arg_run — cstage runtime pin for #148 (D2).
+ *
+ * A module-global slice (`const`/`let []T`) passed BY VALUE as a slice
+ * arg arrived with a GARBAGE header: the slice-IDENT call-arg fast path
+ * (cgen.c:9082) emitted unconditional `MOVQ off+{0,8,16}(BP)` where
+ * off=localfind(name). For a GLOBAL slice ident localfind→0 (locals are
+ * negative), so it read (BP)/8(BP)/16(BP) = saved-BP/RIP/caller garbage
+ * instead of the global's header at name(SB). The fix mirrors the
+ * sibling N_SLICE arm's isglobal dispatch: LEAQ name(SB) into a base
+ * reg, then push 16/8/0 off that base.
+ *
+ * Generalizes to any []T (fast path keys on node_isslice, not u8) — the
+ * []u32 row catches an elem-width assumption. The direct-read control
+ * row (global slice consumed in-place, never passed as an arg) already
+ * worked pre-fix; it locks that the new arm doesn't regress it.
+ *
+ * CSTAGE-ONLY: wwstage's checker rejects a module-level `const`/`let
+ * []T` global ("let: not assignable", #120/#29-kin) → the cgen path is
+ * UNREACHABLE on wwstage, so there is no .s to diverge and 990-997
+ * byte-id stay green. NO byte-id leg here; add it when #120 + the
+ * cgenexpr.ww twin (#125) land.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row { const char *label; const char *src; int want_exit; };
+
+static const struct row rows[] = {
+	/* the path bytes.equal(dot,…) consumer shape: a global []u8 passed
+	 * by value, the callee reading .len AND a byte. seen = len*1000 +
+	 * byte[0]: dotdot = ['.','.'] → 2*1000 + 46 = 2046, truncated to a
+	 * u8 exit code = 2046 & 0xff = 254. */
+	{ "u8_dotdot",
+	  "package main;\n"
+	  "const dotdot: []u8 = ['.', '.'];\n"
+	  "fn seen(bs: []u8) i32 = {\n"
+	  "	let n = bs.len: i32; let f = bs[0]: i32;\n"
+	  "	return n*1000 + f;\n"
+	  "};\n"
+	  "export fn main() i32 = { return seen(dotdot) & 255; };\n",
+	  254 },
+	/* single-element global []u8 — len 1, byte '.' = 46 → 1*100+46. */
+	{ "u8_dot",
+	  "package main;\n"
+	  "const dot: []u8 = ['.'];\n"
+	  "fn seen(bs: []u8) i32 = {\n"
+	  "	let n = bs.len: i32; let f = bs[0]: i32;\n"
+	  "	return n*100 + f;\n"
+	  "};\n"
+	  "export fn main() i32 = { return seen(dot); };\n",
+	  146 },
+	/* []u32 global — proves the fast path is element-width-agnostic
+	 * (header is 3 words regardless of esz). len 3, g[0]=7, g[2]=9
+	 * → 3*100 + 7 + 9 = 316 & 0xff = 60. */
+	{ "u32_global",
+	  "package main;\n"
+	  "const g: []u32 = [7u32, 8u32, 9u32];\n"
+	  "fn seen(xs: []u32) i32 = {\n"
+	  "	let n = xs.len: i32;\n"
+	  "	return n*100 + xs[0]: i32 + xs[2]: i32;\n"
+	  "};\n"
+	  "export fn main() i32 = { return seen(g) & 255; };\n",
+	  60 },
+	/* DIRECT-READ control — global slice consumed in place, NOT passed
+	 * as an arg. Already correct pre-fix; locks no regression. len 2,
+	 * d[0]=11, d[1]=22 → 2*100 + 11 + 22 = 233. */
+	{ "direct_read",
+	  "package main;\n"
+	  "const d: []u32 = [11u32, 22u32];\n"
+	  "export fn main() i32 = {\n"
+	  "	return d.len: i32 * 100 + d[0]: i32 + d[1]: i32;\n"
+	  "};\n",
+	  233 },
+	/* LOCAL slice by-value arg control — exercises the off!=0 arm of the
+	 * SAME fast path (cgen.c:9082), locking that the new global branch
+	 * doesn't regress the unchanged BP-relative local push. len 2,
+	 * byte '.' = 46 → 2*1000 + 46 = 2046 & 0xff = 254. */
+	{ "u8_local_arg",
+	  "package main;\n"
+	  "fn seen(bs: []u8) i32 = {\n"
+	  "	let n = bs.len: i32; let f = bs[0]: i32;\n"
+	  "	return n*1000 + f;\n"
+	  "};\n"
+	  "export fn main() i32 = {\n"
+	  "	let a: [2]u8 = ['.', '.'];\n"
+	  "	let s: []u8 = a[0:2];\n"
+	  "	return seen(s) & 255;\n"
+	  "};\n",
+	  254 },
+	{ NULL, NULL, 0 }
+};
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	int n = 0, fail = 0;
+	for (int i = 0; rows[i].src; i++, n++) {
+		char src[64];
+		snprintf(src, sizeof src, "/tmp/wwgsa_%d_%d.ww", getpid(), i);
+		FILE *f = fopen(src, "wb");
+		if (f == NULL) { fail++; continue; }
+		fputs(rows[i].src, f);
+		fclose(f);
+
+		char tmpdir[64];
+		snprintf(tmpdir, sizeof tmpdir, "/tmp/wwgsa_%d_d_%d",
+		    getpid(), i);
+		mkdir(tmpdir, 0755);
+
+		char cmd[2048];
+		snprintf(cmd, sizeof cmd, "cd %s && %s/ww build %s",
+		    tmpdir, bin, src);
+		if (runwait(cmd) != 0) {
+			fprintf(stderr, "row[%s]: cstage build failed\n",
+			    rows[i].label);
+			fail++;
+			unlink(src); rmdir(tmpdir);
+			continue;
+		}
+
+		char outbin[128];
+		const char *base = strrchr(src, '/');
+		base = base ? base + 1 : src;
+		snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+		char *dot = strrchr(outbin, '.');
+		if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+		int got = runwait(outbin);
+		if (got != rows[i].want_exit) {
+			fprintf(stderr, "row[%s]: cstage exit %d, want %d\n",
+			    rows[i].label, got, rows[i].want_exit);
+			fail++;
+		}
+		unlink(outbin); rmdir(tmpdir);
+		unlink(src);
+	}
+
+	if (fail) {
+		fprintf(stderr, "%d/%d globalslice-arg tests failed\n",
+		    fail, n);
+		return 1;
+	}
+	printf("globalslice_arg: %d/%d ok (cstage run)\n", n, n);
+	return 0;
+}