diff --git a/project/ble_peripheral/ble_app_bladder_patch/command/handlers/cmd_sensor.c b/project/ble_peripheral/ble_app_bladder_patch/command/handlers/cmd_sensor.c
index c1677ee..c11140b 100644
--- a/project/ble_peripheral/ble_app_bladder_patch/command/handlers/cmd_sensor.c
+++ b/project/ble_peripheral/ble_app_bladder_patch/command/handlers/cmd_sensor.c
@@ -10,6 +10,7 @@
 
 #include "cmd_common.h"
 #include "cmd_sensor.h"
+#include "app_raw.h"
 
 /*==============================================================================
  * msn? -> rsn:  Battery level ADC measurement
@@ -58,6 +59,12 @@ int Cmd_mst(const ParsedCmd *cmd)
 int Cmd_msp(const ParsedCmd *cmd)
 {
     (void)cmd;
+
+    if (imu_fifo_capture_is_active())
+    {
+        return 1;   // already owned by mtb?/mim?, ignore duplicate request
+    }
+
     hw_i2c_init_once();
     imu_read_direct();
     return 1;
@@ -78,6 +85,11 @@ int Cmd_mim(const ParsedCmd *cmd)
     int rc;
     (void)cmd;
 
+    if (imu_fifo_capture_is_active())
+    {
+        return 1;   // already owned by mtb?/mim?, ignore duplicate request
+    }
+
     rc = imu_fifo_capture_start();
     if (rc != 0)
     {
diff --git a/project/ble_peripheral/ble_app_bladder_patch/main.h b/project/ble_peripheral/ble_app_bladder_patch/main.h
index e404304..85a0c38 100644
--- a/project/ble_peripheral/ble_app_bladder_patch/main.h
+++ b/project/ble_peripheral/ble_app_bladder_patch/main.h
@@ -53,8 +53,10 @@
 *      : Unify both IMU direct-read and FIFO outputs as raw data in datasheet axis convention.
 *      : Added mim? command (rim:, IMU FIFO-only 15 samples at 50 Hz).
 *   - VBTFW0120 260615 jhChun : Add EMC mitigation logic for BLE link stability: extended supervision timeout and dynamic TX power control based on RSSI, RSSI silence, HVN latency, and TX queue congestion.
+*   - VBTFW0121 260703 jhChun : Add mim? cammand.
+*   - VBTFW0122 260708 jhChun : Prevent IMU FIFO reentry and add MCLK ready timeout.
 ------------------------------------------------------------------------- */
-#define FIRMWARE_VERSION                "VBTFW0120"
+#define FIRMWARE_VERSION                "VBTFW0122"
 
 /*==============================================================================
  * Data Length Constants
diff --git a/project/ble_peripheral/ble_app_bladder_patch/measurement/imu/Invn/imu/inv_imu_transport.c b/project/ble_peripheral/ble_app_bladder_patch/measurement/imu/Invn/imu/inv_imu_transport.c
index 8ed3b17..d77f090 100644
--- a/project/ble_peripheral/ble_app_bladder_patch/measurement/imu/Invn/imu/inv_imu_transport.c
+++ b/project/ble_peripheral/ble_app_bladder_patch/measurement/imu/Invn/imu/inv_imu_transport.c
@@ -101,6 +101,7 @@ int inv_imu_switch_on_mclk(struct inv_imu_device *s)
 	int status = 0;
 	uint8_t data;
 	struct inv_imu_transport *t = (struct inv_imu_transport *)s;
+	uint64_t start;
 
 	/* set IDLE bit only if it is not set yet */
 	if (t->need_mclk_cnt == 0) {
@@ -112,9 +113,23 @@ int inv_imu_switch_on_mclk(struct inv_imu_device *s)
 		if (status)
 			return status;
 
+		start = inv_imu_get_time_us();
+		
 		/* Check if MCLK is ready */
 		do {
 			status = inv_imu_read_reg(s, MCLK_RDY, 1, &data); 
+
+			/* Bound the MCLK wait so a bad IMU/I2C state cannot hang the main loop. */
+			if ((inv_imu_get_time_us() - start) >= 50000U)
+			{
+				status = 0;
+				if (inv_imu_read_reg(s, PWR_MGMT0, 1, &data) == 0)
+				{
+					data &= ~PWR_MGMT0_IDLE_MASK;
+					(void)inv_imu_write_reg(s, PWR_MGMT0, 1, &data);
+				}
+				return INV_ERROR_TIMEOUT;
+			}
 		} while ((status != 0) || !(data & MCLK_RDY_MCLK_RDY_MASK));
 	} else {