diff --git a/src/hostdemo.rs b/src/hostdemo.rs
index 95815c1..3d6949e 100644
--- a/src/hostdemo.rs
+++ b/src/hostdemo.rs
@@ -93,9 +93,10 @@ fn build_rdm_frame(dest: &[u8; 6], tn: u8, qseq: u16, cc: u8, pid: u16, pd: &[u8
     f[0x51] = (pid & 0xFF) as u8;
     f[0x52] = pd.len() as u8;
     f[0x53..0x53 + pd.len()].copy_from_slice(pd);
-    // checksum: 含隐式 0xCC 起始字节, 从 CC 起 msgLen 字节 (不含自身), BE
+    // checksum: 含隐式 0xCC 起始字节, Σ(0x3C..0x53+PDL) (不含 checksum 槽位自身!), BE
+    // ★历史 bug: 曾写成 0x3C..0x3C+msg_len 多算 1 字节(含模板残留旧 checksum) → Butler 不应答
     let mut sum: u16 = 0xCC;
-    for i in 0x3C..0x3C + msg_len { sum = sum.wrapping_add(f[i] as u16); }
+    for i in 0x3C..0x53 + pd.len() { sum = sum.wrapping_add(f[i] as u16); }
     let cs = 0x53 + pd.len();
     f[cs] = (sum >> 8) as u8;
     f[cs + 1] = (sum & 0xFF) as u8;