diff --git a/client/android/app/src/main/AndroidManifest.xml b/client/android/app/src/main/AndroidManifest.xml
index 8e0188f..99b3c2b 100644
--- a/client/android/app/src/main/AndroidManifest.xml
+++ b/client/android/app/src/main/AndroidManifest.xml
@@ -4,6 +4,9 @@
     <!-- 网络权限（隧道流量） -->
     <uses-permission android:name="android.permission.INTERNET" />
 
+    <!-- 默认网络监听需要（DefaultNetworkMonitor 用 ConnectivityManager 取默认接口） -->
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+
     <!-- 前台服务（VPN 持续运行所需，API 28+） -->
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
 
diff --git a/client/android/app/src/main/kotlin/com/pangolin/pangolin_vpn/PangolinVpnService.kt b/client/android/app/src/main/kotlin/com/pangolin/pangolin_vpn/PangolinVpnService.kt
index 6c96801..c881953 100644
--- a/client/android/app/src/main/kotlin/com/pangolin/pangolin_vpn/PangolinVpnService.kt
+++ b/client/android/app/src/main/kotlin/com/pangolin/pangolin_vpn/PangolinVpnService.kt
@@ -391,7 +391,9 @@ class PangolinVpnService : VpnService(), PlatformInterface, CommandServerHandler
                 runCatching { box.setMTU(ni.mtu) }
                 box.addresses = StringArray(
                     ni.interfaceAddresses.mapNotNull { ia ->
-                        val host = ia.address?.hostAddress ?: return@mapNotNull null
+                        // 砍掉 IPv6 link-local 的 zone 标识(如 %rmnet_data0)——
+                        // sing-box netip.ParsePrefix 不接受 prefix 内含 zone，否则 panic。
+                        val host = ia.address?.hostAddress?.substringBefore('%') ?: return@mapNotNull null
                         "$host/${ia.networkPrefixLength}"
                     }.iterator()
                 )