diff --git a/Makefile b/Makefile
index 1b3ce205..3ffb472c 100644
--- a/Makefile
+++ b/Makefile
@@ -292,6 +292,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_amp_dot_idx \
 	  $(BIN)/test_alias_chain_unwrap \
 	  $(BIN)/test_letbind_void_bang_void \
+	  $(BIN)/test_cgalloc_str_field \
 	  $(BIN)/test_param_shadow_mod \
 	  $(BIN)/test_localoff_scope \
 	  $(BIN)/test_cast_enum_movl \
@@ -769,6 +770,12 @@ $(BIN)/test_letbind_void_bang_void: test/wcc/757_letbind_void_bang_void.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_cgalloc_str_field: test/wcc/758_cgalloc_str_field.c \
+		$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_match_4arm_cross_module_run: test/wcc/929_match_4arm_cross_module_run.c \
 		$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
 		$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww
index 7a9bf817..7c354586 100644
--- a/selfhost/cmd/w6c/main.combined.ww
+++ b/selfhost/cmd/w6c/main.combined.ww
@@ -15984,6 +15984,19 @@ fn cgalloc(c: *cgen, n: *node) void = {
 								emitint(fi.foff: i64);
 								emitline("(BX)\n");
 								fi = nil;
+							} else { if (isstrtype(c, fi.tnode)) {
+								// alloc(T{ fval = s }) for str field: cgexpr
+								// leaves (AX=ptr, BX=len). Use CX for the heap
+								// base so BX=len survives both stores. Mirrors
+								// cmd/w6c/cgen.c:4184-4190.
+								emitline("\tMOVQ\t(SP), CX\n");
+								emitline("\tMOVQ\tAX, ");
+								emitint(fi.foff: i64);
+								emitline("(CX)\n");
+								emitline("\tMOVQ\tBX, ");
+								emitint((fi.foff + 8): i64);
+								emitline("(CX)\n");
+								fi = nil;
 							} else {
 								emitline("\tMOVQ\t(SP), BX\n");
 								let sop: str = fieldstoreop(c, fi);
@@ -15993,7 +16006,7 @@ fn cgalloc(c: *cgen, n: *node) void = {
 								emitint(fi.foff: i64);
 								emitline("(BX)\n");
 								fi = nil;
-							};
+							};};
 						} else {
 							fi = fi.finext;
 						};
diff --git a/selfhost/cmd/wcc/cgenexpr.ww b/selfhost/cmd/wcc/cgenexpr.ww
index af0a94a6..81448ada 100644
--- a/selfhost/cmd/wcc/cgenexpr.ww
+++ b/selfhost/cmd/wcc/cgenexpr.ww
@@ -2775,6 +2775,19 @@ fn cgalloc(c: *cgen, n: *node) void = {
 								emitint(fi.foff: i64);
 								emitline("(BX)\n");
 								fi = nil;
+							} else { if (isstrtype(c, fi.tnode)) {
+								// alloc(T{ fval = s }) for str field: cgexpr
+								// leaves (AX=ptr, BX=len). Use CX for the heap
+								// base so BX=len survives both stores. Mirrors
+								// cmd/w6c/cgen.c:4184-4190.
+								emitline("\tMOVQ\t(SP), CX\n");
+								emitline("\tMOVQ\tAX, ");
+								emitint(fi.foff: i64);
+								emitline("(CX)\n");
+								emitline("\tMOVQ\tBX, ");
+								emitint((fi.foff + 8): i64);
+								emitline("(CX)\n");
+								fi = nil;
 							} else {
 								emitline("\tMOVQ\t(SP), BX\n");
 								let sop: str = fieldstoreop(c, fi);
@@ -2784,7 +2797,7 @@ fn cgalloc(c: *cgen, n: *node) void = {
 								emitint(fi.foff: i64);
 								emitline("(BX)\n");
 								fi = nil;
-							};
+							};};
 						} else {
 							fi = fi.finext;
 						};
diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww
index 51eac1e7..17ff1832 100644
--- a/selfhost/cmd/wwdump/main.combined.ww
+++ b/selfhost/cmd/wwdump/main.combined.ww
@@ -15984,6 +15984,19 @@ fn cgalloc(c: *cgen, n: *node) void = {
 								emitint(fi.foff: i64);
 								emitline("(BX)\n");
 								fi = nil;
+							} else { if (isstrtype(c, fi.tnode)) {
+								// alloc(T{ fval = s }) for str field: cgexpr
+								// leaves (AX=ptr, BX=len). Use CX for the heap
+								// base so BX=len survives both stores. Mirrors
+								// cmd/w6c/cgen.c:4184-4190.
+								emitline("\tMOVQ\t(SP), CX\n");
+								emitline("\tMOVQ\tAX, ");
+								emitint(fi.foff: i64);
+								emitline("(CX)\n");
+								emitline("\tMOVQ\tBX, ");
+								emitint((fi.foff + 8): i64);
+								emitline("(CX)\n");
+								fi = nil;
 							} else {
 								emitline("\tMOVQ\t(SP), BX\n");
 								let sop: str = fieldstoreop(c, fi);
@@ -15993,7 +16006,7 @@ fn cgalloc(c: *cgen, n: *node) void = {
 								emitint(fi.foff: i64);
 								emitline("(BX)\n");
 								fi = nil;
-							};
+							};};
 						} else {
 							fi = fi.finext;
 						};
diff --git a/test/wcc/758_cgalloc_str_field.c b/test/wcc/758_cgalloc_str_field.c
new file mode 100644
index 00000000..2310f481
--- /dev/null
+++ b/test/wcc/758_cgalloc_str_field.c
@@ -0,0 +1,223 @@
+/*
+ * 758_cgalloc_str_field — cgalloc N_STRUCTLIT str-field store (task #22).
+ *
+ * Pre-fix: wwstage cgalloc's per-field walk routed str-typed fields
+ * through the generic `MOVQ (SP), BX ; MOVQ AX, foff(BX)` path, which
+ * landed only AX (str.ptr) and clobbered BX (str.len) with the heap
+ * base. str.len silently stayed zero (rt_alloc is MAP_ANON-backed, so
+ * the slot was zero-init rather than garbage — but still wrong). 990
+ * and 995 byte-identity didn't catch this because nothing in the
+ * bootstrapped selfhost source uses `alloc(T { strfield = "..." })!`.
+ *
+ * Fix: a str-field-typed branch mirrors cmd/w6c/cgen.c:4184-4190 —
+ * route the heap base through CX so BX=len survives both stores
+ * (ptr at foff+0, len at foff+8). Task #23 (slice/tagged/fn-pair
+ * multi-word fields) is the broader follow-up; this row pins str.
+ *
+ * Each row runs the generated binary under cstage and (when present)
+ * wwstage; the exit code is the regression-catching gate. The cstage
+ * row is the cross-check oracle.
+ *
+ * Byte-identity is intentionally NOT checked here. cgalloc N_STRUCTLIT
+ * already diverges on two pre-existing axes that 995_self_rebuild
+ * doesn't exercise because selfhost source uses amalloc, never
+ * `alloc(T{...})!`:
+ *   - `CALL alloc(SB)` (cstage, via ffi_resolve) vs `CALL rt_alloc(SB)`
+ *     (wwstage, hardcoded symbol).
+ *   - `(BX)` (cstage txt.c omits zero displacement) vs `0(BX)`
+ *     (wwstage emitint(0) is unconditional). The new str branch
+ *     follows the existing float / int branch shape and inherits the
+ *     same formatting; aligning all three with cstage is a separate
+ *     follow-up.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row { const char *label; const char *src; int want; };
+
+static const struct row rows[] = {
+	/* Singleton str field. Pre-fix p.s.len stayed 0; post-fix 5. */
+	{ "alloc_str_singleton",
+	  "package main;\n"
+	  "import os;\n"
+	  "type holder = struct { s: str };\n"
+	  "fn main() i32 = {\n"
+	  "    let p: *holder = alloc(holder { s = \"hello\" })!;\n"
+	  "    return p.s.len;\n"
+	  "};\n",
+	  5 },
+	/* i32 field before str. Verifies field iteration restarts cleanly
+	 * after the str-field branch and that the i32 store path is
+	 * unaffected. Pre-fix: 100 + 0 = 100; post-fix: 100 + 2 = 102. */
+	{ "alloc_i32_then_str",
+	  "package main;\n"
+	  "import os;\n"
+	  "type holder = struct { n: i32, s: str };\n"
+	  "fn main() i32 = {\n"
+	  "    let p: *holder = alloc(holder { n = 100, s = \"hi\" })!;\n"
+	  "    return p.n + p.s.len;\n"
+	  "};\n",
+	  102 },
+	/* str field before i32. Verifies foff>0 routing for the trailing
+	 * i32 store after the str-field branch. Pre-fix: 0 + 7 = 7;
+	 * post-fix: 5 + 7 = 12. */
+	{ "alloc_str_then_i32",
+	  "package main;\n"
+	  "import os;\n"
+	  "type holder = struct { s: str, n: i32 };\n"
+	  "fn main() i32 = {\n"
+	  "    let p: *holder = alloc(holder { s = \"world\", n = 7 })!;\n"
+	  "    return p.s.len + p.n;\n"
+	  "};\n",
+	  12 },
+	/* Two str fields. Pre-fix both lens stayed 0; post-fix 3 + 6 = 9.
+	 * Pins that `fi = nil` advances correctly between str fields. */
+	{ "alloc_two_str",
+	  "package main;\n"
+	  "import os;\n"
+	  "type holder = struct { a: str, b: str };\n"
+	  "fn main() i32 = {\n"
+	  "    let p: *holder = alloc(holder { a = \"foo\", b = \"barbaz\" })!;\n"
+	  "    return p.a.len + p.b.len;\n"
+	  "};\n",
+	  9 },
+	/* Float-then-str-then-int. Pre-fix str.len=0 so result is
+	 * 0 + 10 = 10; post-fix 3 + 10 = 13. Confirms the str-field
+	 * branch slots between the existing float and integer branches
+	 * without disrupting either. */
+	{ "alloc_f64_str_i32",
+	  "package main;\n"
+	  "import os;\n"
+	  "type holder = struct { f: f64, s: str, n: i32 };\n"
+	  "fn main() i32 = {\n"
+	  "    let p: *holder = alloc(holder { f = 1.5f64, s = \"abc\", n = 10 })!;\n"
+	  "    return p.s.len + p.n;\n"
+	  "};\n",
+	  13 },
+	/* Read-back via p.s[i]: confirms str.ptr survived the store
+	 * (foff=0 case) while still pinning str.len. Pre-fix len=0 so
+	 * the loop body never executes; post-fix sum is 'h'+'i' = 209.
+	 * Indexes the string by hand to avoid pulling in stdlib. */
+	{ "alloc_str_readback",
+	  "package main;\n"
+	  "import os;\n"
+	  "type holder = struct { s: str };\n"
+	  "fn main() i32 = {\n"
+	  "    let p: *holder = alloc(holder { s = \"hi\" })!;\n"
+	  "    let sum: i32 = 0;\n"
+	  "    let i: i32 = 0;\n"
+	  "    for (i < p.s.len) {\n"
+	  "        sum += p.s[i]: i32;\n"
+	  "        i += 1;\n"
+	  "    };\n"
+	  "    return sum;\n"
+	  "};\n",
+	  209 },
+};
+
+/* run_driver — compile r->src via the given driver and exec; return
+ * the process exit code. Mirror of 703/704. */
+static int
+run_driver(const char *driver, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/wcas_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/wcas_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -1;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s",
+	    tmpdir, driver, src);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "row[%s]: build via %s failed\n",
+		    r->label, driver);
+		unlink(src); rmdir(tmpdir);
+		return -1;
+	}
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+	int got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return got;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	char wdrv[1024];
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+
+	struct { const char *name; const char *path; int gated_on_existence; }
+	drivers[] = {
+		{ "cstage",  cdrv, 0 },
+		{ "wwstage", wdrv, 1 },
+		{ NULL, NULL, 0 },
+	};
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int d = 0; drivers[d].name; d++) {
+		if (drivers[d].gated_on_existence
+		    && access(drivers[d].path, X_OK) != 0) {
+			fprintf(stderr, "cgalloc_str_field: skip %s (no %s)\n",
+			    drivers[d].name, drivers[d].path);
+			continue;
+		}
+		for (int i = 0; i < n; i++) {
+			int got = run_driver(drivers[d].path, &rows[i], i);
+			total++;
+			if (got != rows[i].want) {
+				fprintf(stderr,
+				    "cgalloc_str_field[%s][%s]: exit=%d want=%d\n",
+				    drivers[d].name, rows[i].label,
+				    got, rows[i].want);
+				fail++;
+			}
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr,
+		    "cgalloc_str_field: %d/%d fixtures failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("cgalloc_str_field: %d/%d ok\n", total, total);
+	return 0;
+}