diff --git a/lib/services/title_api_service.dart b/lib/services/title_api_service.dart
index b2530bd..17fdc7b 100644
--- a/lib/services/title_api_service.dart
+++ b/lib/services/title_api_service.dart
@@ -222,7 +222,11 @@ class TitleApiService {
       num3 += n % 2;
       n >>= 1;
     }
-    return num3;
+    // 原版 num5 是 C# 的 int，`<<=` 溢出按二进制补码环绕，所以结果恒为合法的
+    // signed int32（高位被置起时是负数）。Dart 的 int 是 64 位且 n 恒为正，
+    // 不重解释就会产出 >2^31 的正数，超出 UserGamePlaylog.playSpecial 的 int
+    // 声明，服务器反序列化失败直接返回 HTTP 500。
+    return num3.toSigned(32);
   }
 
   String _normalizeUrl(String url) {
diff --git a/lib/services/user_all_payload_builder.dart b/lib/services/user_all_payload_builder.dart
index e673cc7..06ccf9b 100644
--- a/lib/services/user_all_payload_builder.dart
+++ b/lib/services/user_all_payload_builder.dart
@@ -260,6 +260,7 @@ class UserAllPayloadBuilder {
       'extNum4': 0,
       'extBool1': false,
       'extBool2': false,
+      'extBool3': false,
     };
     for (var i = 0; i < 5; i++) {
       playlog['characterId${i + 1}'] = paddedCharaSlot[i];
diff --git a/test/calc_random_test.dart b/test/calc_random_test.dart
new file mode 100644
index 0000000..1cb512f
--- /dev/null
+++ b/test/calc_random_test.dart
@@ -0,0 +1,15 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:ichino/services/title_api_service.dart';
+
+void main() {
+  // UserGamePlaylog.playSpecial 在客户端里声明为 int(int32)。越界会让服务器
+  // 反序列化失败并返回 HTTP 500，而旧实现有约一半概率越界。
+  test('calcRandom 恒在 int32 范围内', () {
+    const min = -2147483648;
+    const max = 2147483647;
+    for (var i = 0; i < 20000; i++) {
+      final v = TitleApiService.calcRandom();
+      expect(v, inInclusiveRange(min, max), reason: '第 $i 次采样得到 $v');
+    }
+  });
+}