diff --git a/daemon/src/decoder.c b/daemon/src/decoder.c
index 9d85ee8..e91eb35 100644
--- a/daemon/src/decoder.c
+++ b/daemon/src/decoder.c
@@ -416,8 +416,21 @@ int daedalus_decoder_run_request(struct daedalus_decoder *dec,
 
 		dec->pkt->data = assembled;
 		dec->pkt->size = (int) assembled_len;
-		log_debug("decoder: h264 prepended SPS=%zuB PPS=%zuB slice=%uB",
-			  sps_len, pps_len, req->bitstream_len);
+		log_info("decoder: h264 SPS prof=%u level=%u ref_frames=%u w_mbs=%u h_units=%u poc_type=%u flags=0x%x",
+			 h264_meta->sps.profile_idc,
+			 h264_meta->sps.level_idc,
+			 h264_meta->sps.max_num_ref_frames,
+			 h264_meta->sps.pic_width_in_mbs_minus1,
+			 h264_meta->sps.pic_height_in_map_units_minus1,
+			 h264_meta->sps.pic_order_cnt_type,
+			 h264_meta->sps.flags);
+		log_info("decoder: h264 PPS spsid=%u ppsid=%u qp-26=%d flags=0x%x",
+			 h264_meta->pps.seq_parameter_set_id,
+			 h264_meta->pps.pic_parameter_set_id,
+			 h264_meta->pps.pic_init_qp_minus26,
+			 h264_meta->pps.flags);
+		log_info("decoder: h264 prepended SPS=%zuB PPS=%zuB slice=%uB",
+			 sps_len, pps_len, req->bitstream_len);
 	} else {
 		/*
 		 * VP9/AV1: bitstream is self-contained per frame, point the
diff --git a/kernel/daedalus_v4l2_main.c b/kernel/daedalus_v4l2_main.c
index ffc616b..b493a4b 100644
--- a/kernel/daedalus_v4l2_main.c
+++ b/kernel/daedalus_v4l2_main.c
@@ -677,6 +677,28 @@ static void daedalus_device_run(void *priv)
 		goto fail_buf_error;
 	}
 
+	/*
+	 * Bind the in-flight media_request's stateless control values to
+	 * the ctrl_handler's p_cur slots so daedalus_collect_h264_meta()
+	 * sees this request's SPS/PPS/scaling_matrix/decode_params — not
+	 * the previous request's stale values (or driver defaults from
+	 * v4l2_ctrl_new_custom when no prior request has run yet).
+	 *
+	 * Without this, p_cur reads back zero/default for everything the
+	 * userspace driver set via S_EXT_CTRLS with
+	 * V4L2_CTRL_WHICH_REQUEST_VAL — caught by libva-v4l2-request-
+	 * fourier's libva-boundary instrumentation (issue #8) showing
+	 * num_ref_frames=1 sent vs. ref_frames=0 read.  Pair with the
+	 * v4l2_ctrl_request_complete call already present in the
+	 * completion path (daedalus_complete_resp_frame).
+	 *
+	 * cedrus / rkvdec / hantro all call this from device_run; the
+	 * m2m core does NOT do it automatically.
+	 */
+	if (src_buf->vb2_buf.req_obj.req)
+		v4l2_ctrl_request_setup(src_buf->vb2_buf.req_obj.req,
+					&ctx->hdl);
+
 	{
 		u32 cid = daedalus_fourcc_to_codec_id(ctx->src_fmt.pixelformat);
 		size_t meta_len = 0;