diff --git a/doc/learn.md b/doc/learn.md
index 076106a..e299129 100644
--- a/doc/learn.md
+++ b/doc/learn.md
@@ -1153,6 +1153,9 @@ script behavior for local SDK checkouts.
 serialized ObjectPool payload physical offset plus the current binary base.
 That address is useful after the `-r -p` script maps a malloc-backed ObjectPool
 image and sets `anal.gp`/`x27`, but it should not be required for xref recovery.
+The r2 setup script must clear `anal.roregs` before `dr x27=...` and then
+restore `anal.roregs=x27,gp,zero`; otherwise radare2 refuses to update `x27`
+when it is already marked read-only.
 
 For xrefs, prefer resolving collected PP offsets against the serialized
 ObjectPool fill payload (`DartPpInfo.paddr` / `source_addr`) and then walking
diff --git a/doc/support.md b/doc/support.md
index c7571cc..f0755ef 100644
--- a/doc/support.md
+++ b/doc/support.md
@@ -452,8 +452,8 @@ The `-R` path emits:
 - `PP=x27`; per-function PP offset helper scanning is intentionally skipped by
   default in script output because it is too slow on large apps
 - `-r -p` is the focused PP setup path: it opens a malloc map at the synthetic
-  PP base, writes the reconstructed ObjectPool image, and sets `e anal.gp` plus
-  `dr x27`
+  PP base, writes the reconstructed ObjectPool image, sets `e anal.gp`, clears
+  `anal.roregs` before assigning `x27`, then restores `anal.roregs=x27,gp,zero`
 
 ## Practical Limits
 
diff --git a/src/lib/dart_pool_parse.c b/src/lib/dart_pool_parse.c
index 36a5c32..1b47319 100644
--- a/src/lib/dart_pool_parse.c
+++ b/src/lib/dart_pool_parse.c
@@ -1103,7 +1103,9 @@ static char *dump_pp_r2(const DartPpInfo *info, bool quiet) {
 	r_strbuf_appendf (sb, "s 0x%" PFMT64x "\n", info->base);
 	r_strbuf_appendf (sb, "wx %s\n", hex);
 	r_strbuf_appendf (sb, "e anal.gp=0x%" PFMT64x "\n", info->base);
+	r_strbuf_append (sb, "e anal.roregs=\n");
 	r_strbuf_appendf (sb, "dr x27=0x%" PFMT64x "\n", info->base);
+	r_strbuf_append (sb, "e anal.roregs=x27,gp,zero\n");
 	r_strbuf_appendf (sb, "f PP = 0x%" PFMT64x "\n", info->base);
 	r_strbuf_appendf (sb, "f dart.pp 0x%" PFMT64x " @ 0x%" PFMT64x "\n", info->size, info->base);
 	r_strbuf_appendf (sb, "f dart.pp.entries 0x%" PFMT64x " @ 0x%" PFMT64x "\n", info->entry_bits_offset - info->entries_offset, info->base + info->entries_offset);
diff --git a/test/db/cmd/pp-android b/test/db/cmd/pp-android
index 06faf9a..80b7db2 100644
--- a/test/db/cmd/pp-android
+++ b/test/db/cmd/pp-android
@@ -21,12 +21,14 @@ RUN
 NAME=pp-r2-android
 FILE=-
 CMDS=<<EOF
-!!../bin/r2flutter -q -r -p bins/android/mafia 2>/dev/null | grep -E '^(o malloc://|e anal[.]gp=|dr x27=|f PP =|f dart[.]pp )'
+!!../bin/r2flutter -q -r -p bins/android/mafia 2>/dev/null | grep -E '^(o malloc://|e anal[.]gp=|dr anal[.]roregs=|dr x27=|f PP =|f dart[.]pp )'
 EOF
 EXPECT=<<EOF
 o malloc://0x66548 0x385154 rw
 e anal.gp=0x385154
+dr anal.roregs=
 dr x27=0x385154
+dr anal.roregs=x27,gp,zero
 f PP = 0x385154
 f dart.pp 0x66548 @ 0x385154
 EOF