diff --git a/Lib/_opcode_metadata.py b/Lib/_opcode_metadata.py
index 529f5cbf65..5734d6141a 100644
--- a/Lib/_opcode_metadata.py
+++ b/Lib/_opcode_metadata.py
@@ -132,9 +132,6 @@
     'BUILD_SET_FROM_TUPLES': 122,
     'BUILD_TUPLE_FROM_ITER': 123,
     'BUILD_TUPLE_FROM_TUPLES': 124,
-    'CALL_METHOD_POSITIONAL': 125,
-    'CALL_METHOD_KEYWORD': 126,
-    'CALL_METHOD_EX': 127,
     'CONTINUE': 128,
     'JUMP_IF_FALSE_OR_POP': 129,
     'JUMP_IF_TRUE_OR_POP': 130,
@@ -146,7 +143,7 @@
     'RESUME': 149,
     'JUMP': 252,
     'LOAD_CLOSURE': 253,
-    'LOAD_METHOD': 254,
+    'LOAD_ATTR_METHOD': 254,
     'POP_BLOCK': 255,
 }
 
diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
index 11c617b5f3..1489fb666e 100644
--- a/Lib/test/test_xml_etree.py
+++ b/Lib/test/test_xml_etree.py
@@ -2301,7 +2301,6 @@ def test_bug_xmltoolkit62(self):
         self.assertEqual(t.find('.//paragraph').text,
             'A new cultivar of Begonia plant named \u2018BCT9801BEG\u2019.')
 
-    @unittest.expectedFailure # TODO: RUSTPYTHON
     @unittest.skipIf(sys.gettrace(), "Skips under coverage.")
     def test_bug_xmltoolkit63(self):
         # Check reference leak.
diff --git a/crates/codegen/src/compile.rs b/crates/codegen/src/compile.rs
index f61b01a43e..1f12cc8707 100644
--- a/crates/codegen/src/compile.rs
+++ b/crates/codegen/src/compile.rs
@@ -98,12 +98,6 @@ enum NameUsage {
     Delete,
 }
 
-enum CallType {
-    Positional { nargs: u32 },
-    Keyword { nargs: u32 },
-    Ex { has_kwargs: bool },
-}
-
 fn is_forbidden_name(name: &str) -> bool {
     // See https://docs.python.org/3/library/constants.html#built-in-constants
     const BUILTIN_CONSTANTS: &[&str] = &["__debug__"];
@@ -1034,12 +1028,16 @@ impl Compiler {
                 if preserve_tos {
                     emit!(self, Instruction::Swap { index: 2 });
                 }
+                // Stack after swap: [..., return_value, __exit__] or [..., __exit__]
 
-                // Call __exit__(None, None, None) - compiler_call_exit_with_nones
-                // Stack: [..., __exit__] or [..., return_value, __exit__]
+                // Call __exit__(None, None, None)
+                // Call protocol: [callable, self_or_null, arg1, arg2, arg3]
+                emit!(self, Instruction::PushNull);
+                // Stack: [..., __exit__, NULL]
                 self.emit_load_const(ConstantData::None);
                 self.emit_load_const(ConstantData::None);
                 self.emit_load_const(ConstantData::None);
+                // Stack: [..., __exit__, NULL, None, None, None]
                 emit!(self, Instruction::Call { nargs: 3 });
 
                 // For async with, await the result
@@ -1875,6 +1873,7 @@ impl Compiler {
 
                     let assertion_error = self.name("AssertionError");
                     emit!(self, Instruction::LoadGlobal(assertion_error));
+                    emit!(self, Instruction::PushNull);
                     match msg {
                         Some(e) => {
                             self.compile_expression(e)?;
@@ -2092,15 +2091,21 @@ impl Compiler {
         Ok(())
     }
 
+    /// Push decorators onto the stack in source order.
+    /// For @dec1 @dec2 def foo(): stack becomes [dec1, NULL, dec2, NULL]
     fn prepare_decorators(&mut self, decorator_list: &[Decorator]) -> CompileResult<()> {
         for decorator in decorator_list {
             self.compile_expression(&decorator.expression)?;
+            emit!(self, Instruction::PushNull);
         }
         Ok(())
     }
 
+    /// Apply decorators in reverse order (LIFO from stack).
+    /// Stack [dec1, NULL, dec2, NULL, func] -> dec2(func) -> dec1(dec2(func))
+    /// The forward loop works because each Call pops from TOS, naturally
+    /// applying decorators bottom-up (innermost first).
     fn apply_decorators(&mut self, decorator_list: &[Decorator]) {
-        // Apply decorators:
         for _ in decorator_list {
             emit!(self, Instruction::Call { nargs: 1 });
         }
@@ -2142,6 +2147,7 @@ impl Compiler {
 
         // Create type params function with closure
         self.make_closure(code, bytecode::MakeFunctionFlags::empty())?;
+        emit!(self, Instruction::PushNull);
 
         // Call the function immediately
         emit!(self, Instruction::Call { nargs: 0 });
@@ -3224,11 +3230,6 @@ impl Compiler {
                 num_typeparam_args += 1;
             }
 
-            // SWAP if we have both
-            if num_typeparam_args == 2 {
-                emit!(self, Instruction::Swap { index: 2 });
-            }
-
             // Enter type params scope
             let type_params_name = format!("<generic parameters of {name}>");
             self.push_output(
@@ -3307,14 +3308,29 @@ impl Compiler {
             // Make closure for type params code
             self.make_closure(type_params_code, bytecode::MakeFunctionFlags::empty())?;
 
-            // Call the closure
+            // Call the type params closure with defaults/kwdefaults as arguments.
+            // Call protocol: [callable, self_or_null, arg1, ..., argN]
+            // We need to reorder: [args..., closure] -> [closure, NULL, args...]
+            // Using Swap operations to move closure down and insert NULL.
+            // Note: num_typeparam_args is at most 2 (defaults tuple, kwdefaults dict).
             if num_typeparam_args > 0 {
-                emit!(
-                    self,
-                    Instruction::Swap {
-                        index: (num_typeparam_args + 1) as u32
+                match num_typeparam_args {
+                    1 => {
+                        // Stack: [arg1, closure]
+                        emit!(self, Instruction::Swap { index: 2 }); // [closure, arg1]
+                        emit!(self, Instruction::PushNull); // [closure, arg1, NULL]
+                        emit!(self, Instruction::Swap { index: 2 }); // [closure, NULL, arg1]
                     }
-                );
+                    2 => {
+                        // Stack: [arg1, arg2, closure]
+                        emit!(self, Instruction::Swap { index: 3 }); // [closure, arg2, arg1]
+                        emit!(self, Instruction::Swap { index: 2 }); // [closure, arg1, arg2]
+                        emit!(self, Instruction::PushNull); // [closure, arg1, arg2, NULL]
+                        emit!(self, Instruction::Swap { index: 3 }); // [closure, NULL, arg2, arg1]
+                        emit!(self, Instruction::Swap { index: 2 }); // [closure, NULL, arg1, arg2]
+                    }
+                    _ => unreachable!("only defaults and kwdefaults are supported"),
+                }
                 emit!(
                     self,
                     Instruction::Call {
@@ -3322,7 +3338,9 @@ impl Compiler {
                     }
                 );
             } else {
-                // No arguments, just call the closure
+                // Stack: [closure]
+                emit!(self, Instruction::PushNull);
+                // Stack: [closure, NULL]
                 emit!(self, Instruction::Call { nargs: 0 });
             }
         }
@@ -3691,6 +3709,7 @@ impl Compiler {
 
             // Generate class creation code
             emit!(self, Instruction::LoadBuildClass);
+            emit!(self, Instruction::PushNull);
 
             // Set up the class function with type params
             let mut func_flags = bytecode::MakeFunctionFlags::empty();
@@ -3701,43 +3720,91 @@ impl Compiler {
             self.make_closure(class_code, func_flags)?;
             self.emit_load_const(ConstantData::Str { value: name.into() });
 
-            // Compile original bases
-            let base_count = if let Some(arguments) = arguments {
-                for arg in &arguments.args {
-                    self.compile_expression(arg)?;
+            // Compile bases and call __build_class__
+            // Check for starred bases or **kwargs
+            let has_starred = arguments
+                .is_some_and(|args| args.args.iter().any(|arg| matches!(arg, Expr::Starred(_))));
+            let has_double_star =
+                arguments.is_some_and(|args| args.keywords.iter().any(|kw| kw.arg.is_none()));
+
+            if has_starred || has_double_star {
+                // Use CallFunctionEx for *bases or **kwargs
+                // Stack has: [__build_class__, NULL, class_func, name]
+                // Need to build: args tuple = (class_func, name, *bases, .generic_base)
+
+                // Compile bases with gather_elements (handles starred)
+                let (size, unpack) = if let Some(arguments) = arguments {
+                    self.gather_elements(2, &arguments.args)? // 2 = class_func + name already on stack
+                } else {
+                    // Just class_func and name (no bases)
+                    (2, false)
+                };
+
+                // Add .generic_base as final base
+                emit!(self, Instruction::LoadName(dot_generic_base));
+
+                // Build args tuple
+                if unpack {
+                    // Starred: gather_elements produced tuples on stack
+                    emit!(self, Instruction::BuildTuple { size: 1 }); // (.generic_base,)
+                    emit!(self, Instruction::BuildTupleFromTuples { size: size + 1 });
+                } else {
+                    // No starred: individual elements on stack
+                    // size includes class_func + name + bases count, +1 for .generic_base
+                    emit!(self, Instruction::BuildTuple { size: size + 1 });
+                }
+
+                // Build kwargs if needed
+                let has_kwargs = arguments.is_some_and(|args| !args.keywords.is_empty());
+                if has_kwargs {
+                    self.compile_keywords(&arguments.unwrap().keywords)?;
                 }
-                arguments.args.len()
+                emit!(self, Instruction::CallFunctionEx { has_kwargs });
             } else {
-                0
-            };
+                // Simple case: no starred bases, no **kwargs
+                // Compile bases normally
+                let base_count = if let Some(arguments) = arguments {
+                    for arg in &arguments.args {
+                        self.compile_expression(arg)?;
+                    }
+                    arguments.args.len()
+                } else {
+                    0
+                };
 
-            // Load .generic_base as the last base
-            emit!(self, Instruction::LoadName(dot_generic_base));
+                // Load .generic_base as the last base
+                emit!(self, Instruction::LoadName(dot_generic_base));
 
-            let nargs = 2 + u32::try_from(base_count).expect("too many base classes") + 1; // function, name, bases..., generic_base
+                let nargs = 2 + u32::try_from(base_count).expect("too many base classes") + 1;
 
-            // Handle keyword arguments
-            if let Some(arguments) = arguments
-                && !arguments.keywords.is_empty()
-            {
-                for keyword in &arguments.keywords {
-                    if let Some(name) = &keyword.arg {
-                        self.emit_load_const(ConstantData::Str {
+                // Handle keyword arguments (no **kwargs here)
+                if let Some(arguments) = arguments
+                    && !arguments.keywords.is_empty()
+                {
+                    let mut kwarg_names = vec![];
+                    for keyword in &arguments.keywords {
+                        let name = keyword.arg.as_ref().expect(
+                            "keyword argument name must be set (no **kwargs in this branch)",
+                        );
+                        kwarg_names.push(ConstantData::Str {
                             value: name.as_str().into(),
                         });
+                        self.compile_expression(&keyword.value)?;
                     }
-                    self.compile_expression(&keyword.value)?;
+                    self.emit_load_const(ConstantData::Tuple {
+                        elements: kwarg_names,
+                    });
+                    emit!(
+                        self,
+                        Instruction::CallKw {
+                            nargs: nargs
+                                + u32::try_from(arguments.keywords.len())
+                                    .expect("too many keyword arguments")
+                        }
+                    );
+                } else {
+                    emit!(self, Instruction::Call { nargs });
                 }
-                emit!(
-                    self,
-                    Instruction::CallKw {
-                        nargs: nargs
-                            + u32::try_from(arguments.keywords.len())
-                                .expect("too many keyword arguments")
-                    }
-                );
-            } else {
-                emit!(self, Instruction::Call { nargs });
             }
 
             // Return the created class
@@ -3748,21 +3815,22 @@ impl Compiler {
 
             // Execute the type params function
             self.make_closure(type_params_code, bytecode::MakeFunctionFlags::empty())?;
+            emit!(self, Instruction::PushNull);
             emit!(self, Instruction::Call { nargs: 0 });
         } else {
             // Non-generic class: standard path
             emit!(self, Instruction::LoadBuildClass);
+            emit!(self, Instruction::PushNull);
 
             // Create class function with closure
             self.make_closure(class_code, bytecode::MakeFunctionFlags::empty())?;
             self.emit_load_const(ConstantData::Str { value: name.into() });
 
-            let call = if let Some(arguments) = arguments {
-                self.compile_call_inner(2, arguments)?
+            if let Some(arguments) = arguments {
+                self.compile_call_helper(2, arguments)?;
             } else {
-                CallType::Positional { nargs: 2 }
-            };
-            self.compile_normal_call(call);
+                emit!(self, Instruction::Call { nargs: 2 });
+            }
         }
 
         // Step 4: Apply decorators and store (common to both paths)
@@ -3912,6 +3980,7 @@ impl Compiler {
         // Stack: [..., __exit__]
         // Call __exit__(None, None, None)
         self.set_source_range(with_range);
+        emit!(self, Instruction::PushNull);
         self.emit_load_const(ConstantData::None);
         self.emit_load_const(ConstantData::None);
         self.emit_load_const(ConstantData::None);
@@ -6087,49 +6156,36 @@ impl Compiler {
     }
 
     fn compile_call(&mut self, func: &Expr, args: &Arguments) -> CompileResult<()> {
-        let method = if let Expr::Attribute(ExprAttribute { value, attr, .. }) = &func {
+        // Method call: obj → LOAD_ATTR_METHOD → [method, self_or_null] → args → CALL
+        // Regular call: func → PUSH_NULL → args → CALL
+        if let Expr::Attribute(ExprAttribute { value, attr, .. }) = &func {
+            // Method call: compile object, then LOAD_ATTR_METHOD
+            // LOAD_ATTR_METHOD pushes [method, self_or_null] on stack
             self.compile_expression(value)?;
             let idx = self.name(attr.as_str());
-            emit!(self, Instruction::LoadMethod { idx });
-            true
+            emit!(self, Instruction::LoadAttrMethod { idx });
+            self.compile_call_helper(0, args)?;
         } else {
+            // Regular call: push func, then NULL for self_or_null slot
+            // Stack layout: [func, NULL, args...] - same as method call [func, self, args...]
             self.compile_expression(func)?;
-            false
-        };
-        let call = self.compile_call_inner(0, args)?;
-        if method {
-            self.compile_method_call(call)
-        } else {
-            self.compile_normal_call(call)
+            emit!(self, Instruction::PushNull);
+            self.compile_call_helper(0, args)?;
         }
         Ok(())
     }
 
-    fn compile_normal_call(&mut self, ty: CallType) {
-        match ty {
-            CallType::Positional { nargs } => {
-                emit!(self, Instruction::Call { nargs })
-            }
-            CallType::Keyword { nargs } => emit!(self, Instruction::CallKw { nargs }),
-            CallType::Ex { has_kwargs } => emit!(self, Instruction::CallFunctionEx { has_kwargs }),
-        }
-    }
-    fn compile_method_call(&mut self, ty: CallType) {
-        match ty {
-            CallType::Positional { nargs } => {
-                emit!(self, Instruction::CallMethodPositional { nargs })
-            }
-            CallType::Keyword { nargs } => emit!(self, Instruction::CallMethodKeyword { nargs }),
-            CallType::Ex { has_kwargs } => emit!(self, Instruction::CallMethodEx { has_kwargs }),
-        }
-    }
-
-    fn compile_call_inner(
+    /// Compile call arguments and emit the appropriate CALL instruction.
+    /// This is shared between compiler_call and compiler_class.
+    fn compile_call_helper(
         &mut self,
         additional_positional: u32,
         arguments: &Arguments,
-    ) -> CompileResult<CallType> {
-        let count = u32::try_from(arguments.len()).unwrap() + additional_positional;
+    ) -> CompileResult<()> {
+        let args_count = u32::try_from(arguments.len()).expect("too many arguments");
+        let count = args_count
+            .checked_add(additional_positional)
+            .expect("too many arguments");
 
         // Normal arguments:
         let (size, unpack) = self.gather_elements(additional_positional, &arguments.args)?;
@@ -6141,7 +6197,7 @@ impl Compiler {
             }
         }
 
-        let call = if unpack || has_double_star {
+        if unpack || has_double_star {
             // Create a tuple with positional args:
             if unpack {
                 emit!(self, Instruction::BuildTupleFromTuples { size });
@@ -6154,7 +6210,7 @@ impl Compiler {
             if has_kwargs {
                 self.compile_keywords(&arguments.keywords)?;
             }
-            CallType::Ex { has_kwargs }
+            emit!(self, Instruction::CallFunctionEx { has_kwargs });
         } else if !arguments.keywords.is_empty() {
             let mut kwarg_names = vec![];
             for keyword in &arguments.keywords {
@@ -6172,12 +6228,12 @@ impl Compiler {
             self.emit_load_const(ConstantData::Tuple {
                 elements: kwarg_names,
             });
-            CallType::Keyword { nargs: count }
+            emit!(self, Instruction::CallKw { nargs: count });
         } else {
-            CallType::Positional { nargs: count }
-        };
+            emit!(self, Instruction::Call { nargs: count });
+        }
 
-        Ok(call)
+        Ok(())
     }
 
     // Given a vector of expr / star expr generate code which gives either
@@ -6409,6 +6465,7 @@ impl Compiler {
 
         // Create comprehension function with closure
         self.make_closure(code, bytecode::MakeFunctionFlags::empty())?;
+        emit!(self, Instruction::PushNull);
 
         // Evaluate iterated item:
         self.compile_expression(&generators[0].iter)?;
@@ -6838,6 +6895,7 @@ impl Compiler {
             match action {
                 UnwindAction::With { is_async } => {
                     // compiler_call_exit_with_nones
+                    emit!(self, Instruction::PushNull);
                     self.emit_load_const(ConstantData::None);
                     self.emit_load_const(ConstantData::None);
                     self.emit_load_const(ConstantData::None);
diff --git a/crates/codegen/src/snapshots/rustpython_codegen__compile__tests__nested_double_async_with.snap b/crates/codegen/src/snapshots/rustpython_codegen__compile__tests__nested_double_async_with.snap
index 679c5ebade..44eaca18e1 100644
--- a/crates/codegen/src/snapshots/rustpython_codegen__compile__tests__nested_double_async_with.snap
+++ b/crates/codegen/src/snapshots/rustpython_codegen__compile__tests__nested_double_async_with.snap
@@ -5,136 +5,142 @@ expression: "compile_exec(\"\\\nasync def test():\n    for stop_exc in (StopIter
   3           0 LOAD_CONST           (<code object test at ??? file "source_path", line 1>):  1               0 RESUME               (0)
 
   2               1 LOAD_GLOBAL          (0, StopIteration)
-                  2 LOAD_CONST           ("spam")
-                  3 CALL                 (1)
-                  4 LOAD_GLOBAL          (1, StopAsyncIteration)
-                  5 LOAD_CONST           ("ham")
-                  6 CALL                 (1)
-                  7 BUILD_TUPLE          (2)
-                  8 GET_ITER
-            >>    9 FOR_ITER             (123)
-                 10 STORE_FAST           (0, stop_exc)
+                  2 PUSH_NULL
+                  3 LOAD_CONST           ("spam")
+                  4 CALL                 (1)
+                  5 LOAD_GLOBAL          (1, StopAsyncIteration)
+                  6 PUSH_NULL
+                  7 LOAD_CONST           ("ham")
+                  8 CALL                 (1)
+                  9 BUILD_TUPLE          (2)
+                 10 GET_ITER
+            >>   11 FOR_ITER             (129)
+                 12 STORE_FAST           (0, stop_exc)
 
-  3              11 LOAD_GLOBAL          (2, self)
-                 12 LOAD_METHOD          (3, subTest)
-                 13 LOAD_GLOBAL          (4, type)
-                 14 LOAD_FAST            (0, stop_exc)
-                 15 CALL                 (1)
-                 16 LOAD_CONST           (("type"))
-                 17 CALL_METHOD_KW       (1)
-                 18 BEFORE_WITH
-                 19 POP_TOP
+  3              13 LOAD_GLOBAL          (2, self)
+                 14 LOAD_ATTR_METHOD     (3, subTest)
+                 15 LOAD_GLOBAL          (4, type)
+                 16 PUSH_NULL
+                 17 LOAD_FAST            (0, stop_exc)
+                 18 CALL                 (1)
+                 19 LOAD_CONST           (("type"))
+                 20 CALL_KW              (1)
+                 21 BEFORE_WITH
+                 22 POP_TOP
 
-  5              20 LOAD_GLOBAL          (5, egg)
-                 21 CALL                 (0)
-                 22 BEFORE_ASYNC_WITH
-                 23 GET_AWAITABLE
-                 24 LOAD_CONST           (None)
-            >>   25 SEND                 (30)
-                 26 YIELD_VALUE          (1)
-                 27 RESUME               (3)
-                 28 JUMP                 (25)
-                 29 CLEANUP_THROW
-            >>   30 END_SEND
-                 31 POP_TOP
+  5              23 LOAD_GLOBAL          (5, egg)
+                 24 PUSH_NULL
+                 25 CALL                 (0)
+                 26 BEFORE_ASYNC_WITH
+                 27 GET_AWAITABLE
+                 28 LOAD_CONST           (None)
+            >>   29 SEND                 (34)
+                 30 YIELD_VALUE          (1)
+                 31 RESUME               (3)
+                 32 JUMP                 (29)
+                 33 CLEANUP_THROW
+            >>   34 END_SEND
+                 35 POP_TOP
 
-  6              32 LOAD_FAST            (0, stop_exc)
-                 33 RAISE_VARARGS        (Raise)
+  6              36 LOAD_FAST            (0, stop_exc)
+                 37 RAISE_VARARGS        (Raise)
 
-  5              34 LOAD_CONST           (None)
-                 35 LOAD_CONST           (None)
-                 36 LOAD_CONST           (None)
-                 37 CALL                 (3)
-                 38 GET_AWAITABLE
+  5              38 PUSH_NULL
                  39 LOAD_CONST           (None)
-            >>   40 SEND                 (45)
-                 41 YIELD_VALUE          (1)
-                 42 RESUME               (3)
-                 43 JUMP                 (40)
-                 44 CLEANUP_THROW
-            >>   45 END_SEND
-                 46 POP_TOP
-                 47 JUMP                 (69)
-                 48 PUSH_EXC_INFO
-                 49 WITH_EXCEPT_START
-                 50 GET_AWAITABLE
-                 51 LOAD_CONST           (None)
-            >>   52 SEND                 (57)
-                 53 YIELD_VALUE          (1)
-                 54 RESUME               (3)
-                 55 JUMP                 (52)
-                 56 CLEANUP_THROW
-            >>   57 END_SEND
-                 58 TO_BOOL
-                 59 POP_JUMP_IF_TRUE     (61)
-                 60 RERAISE              (2)
-            >>   61 POP_TOP
-                 62 POP_EXCEPT
-                 63 POP_TOP
-                 64 POP_TOP
-                 65 JUMP                 (69)
-                 66 COPY                 (3)
+                 40 LOAD_CONST           (None)
+                 41 LOAD_CONST           (None)
+                 42 CALL                 (3)
+                 43 GET_AWAITABLE
+                 44 LOAD_CONST           (None)
+            >>   45 SEND                 (50)
+                 46 YIELD_VALUE          (1)
+                 47 RESUME               (3)
+                 48 JUMP                 (45)
+                 49 CLEANUP_THROW
+            >>   50 END_SEND
+                 51 POP_TOP
+                 52 JUMP                 (74)
+                 53 PUSH_EXC_INFO
+                 54 WITH_EXCEPT_START
+                 55 GET_AWAITABLE
+                 56 LOAD_CONST           (None)
+            >>   57 SEND                 (62)
+                 58 YIELD_VALUE          (1)
+                 59 RESUME               (3)
+                 60 JUMP                 (57)
+                 61 CLEANUP_THROW
+            >>   62 END_SEND
+                 63 TO_BOOL
+                 64 POP_JUMP_IF_TRUE     (66)
+                 65 RERAISE              (2)
+            >>   66 POP_TOP
                  67 POP_EXCEPT
-                 68 RERAISE              (1)
-            >>   69 JUMP                 (95)
-                 70 PUSH_EXC_INFO
-                 71 COPY                 (1)
+                 68 POP_TOP
+                 69 POP_TOP
+                 70 JUMP                 (74)
+                 71 COPY                 (3)
+                 72 POP_EXCEPT
+                 73 RERAISE              (1)
+            >>   74 JUMP                 (100)
+                 75 PUSH_EXC_INFO
+                 76 COPY                 (1)
 
-  7              72 LOAD_GLOBAL          (6, Exception)
-                 73 JUMP_IF_NOT_EXC_MATCH(91)
-                 74 STORE_FAST           (1, ex)
+  7              77 LOAD_GLOBAL          (6, Exception)
+                 78 JUMP_IF_NOT_EXC_MATCH(96)
+                 79 STORE_FAST           (1, ex)
 
-  8              75 LOAD_GLOBAL          (2, self)
-                 76 LOAD_METHOD          (7, assertIs)
-                 77 LOAD_FAST            (1, ex)
-                 78 LOAD_FAST            (0, stop_exc)
-                 79 CALL_METHOD          (2)
-                 80 POP_TOP
-                 81 JUMP                 (86)
-                 82 LOAD_CONST           (None)
-                 83 STORE_FAST           (1, ex)
-                 84 DELETE_FAST          (1, ex)
-                 85 RAISE_VARARGS        (ReraiseFromStack)
-            >>   86 POP_EXCEPT
+  8              80 LOAD_GLOBAL          (2, self)
+                 81 LOAD_ATTR_METHOD     (7, assertIs)
+                 82 LOAD_FAST            (1, ex)
+                 83 LOAD_FAST            (0, stop_exc)
+                 84 CALL                 (2)
+                 85 POP_TOP
+                 86 JUMP                 (91)
                  87 LOAD_CONST           (None)
                  88 STORE_FAST           (1, ex)
                  89 DELETE_FAST          (1, ex)
-                 90 JUMP                 (103)
-            >>   91 RAISE_VARARGS        (ReraiseFromStack)
-                 92 COPY                 (3)
-                 93 POP_EXCEPT
-                 94 RAISE_VARARGS        (ReraiseFromStack)
+                 90 RAISE_VARARGS        (ReraiseFromStack)
+            >>   91 POP_EXCEPT
+                 92 LOAD_CONST           (None)
+                 93 STORE_FAST           (1, ex)
+                 94 DELETE_FAST          (1, ex)
+                 95 JUMP                 (108)
+            >>   96 RAISE_VARARGS        (ReraiseFromStack)
+                 97 COPY                 (3)
+                 98 POP_EXCEPT
+                 99 RAISE_VARARGS        (ReraiseFromStack)
 
- 10         >>   95 LOAD_GLOBAL          (2, self)
-                 96 LOAD_METHOD          (8, fail)
-                 97 LOAD_FAST            (0, stop_exc)
-                 98 FORMAT_SIMPLE
-                 99 LOAD_CONST           (" was suppressed")
-                100 BUILD_STRING         (2)
-                101 CALL_METHOD          (1)
-                102 POP_TOP
-
-  3         >>  103 LOAD_CONST           (None)
-                104 LOAD_CONST           (None)
-                105 LOAD_CONST           (None)
-                106 CALL                 (3)
+ 10         >>  100 LOAD_GLOBAL          (2, self)
+                101 LOAD_ATTR_METHOD     (8, fail)
+                102 LOAD_FAST            (0, stop_exc)
+                103 FORMAT_SIMPLE
+                104 LOAD_CONST           (" was suppressed")
+                105 BUILD_STRING         (2)
+                106 CALL                 (1)
                 107 POP_TOP
-                108 JUMP                 (122)
-                109 PUSH_EXC_INFO
-                110 WITH_EXCEPT_START
-                111 TO_BOOL
-                112 POP_JUMP_IF_TRUE     (114)
-                113 RERAISE              (2)
-            >>  114 POP_TOP
-                115 POP_EXCEPT
-                116 POP_TOP
-                117 POP_TOP
-                118 JUMP                 (122)
-                119 COPY                 (3)
-                120 POP_EXCEPT
-                121 RERAISE              (1)
-            >>  122 JUMP                 (9)
-            >>  123 RETURN_CONST         (None)
+
+  3         >>  108 PUSH_NULL
+                109 LOAD_CONST           (None)
+                110 LOAD_CONST           (None)
+                111 LOAD_CONST           (None)
+                112 CALL                 (3)
+                113 POP_TOP
+                114 JUMP                 (128)
+                115 PUSH_EXC_INFO
+                116 WITH_EXCEPT_START
+                117 TO_BOOL
+                118 POP_JUMP_IF_TRUE     (120)
+                119 RERAISE              (2)
+            >>  120 POP_TOP
+                121 POP_EXCEPT
+                122 POP_TOP
+                123 POP_TOP
+                124 JUMP                 (128)
+                125 COPY                 (3)
+                126 POP_EXCEPT
+                127 RERAISE              (1)
+            >>  128 JUMP                 (11)
+            >>  129 RETURN_CONST         (None)
 
               1 MAKE_FUNCTION
               2 STORE_NAME           (0, test)
diff --git a/crates/compiler-core/src/bytecode.rs b/crates/compiler-core/src/bytecode.rs
index 19380be471..5020be27c9 100644
--- a/crates/compiler-core/src/bytecode.rs
+++ b/crates/compiler-core/src/bytecode.rs
@@ -921,15 +921,6 @@ pub enum Instruction {
     BuildTupleFromTuples {
         size: Arg<u32>,
     } = 124,
-    CallMethodPositional {
-        nargs: Arg<u32>,
-    } = 125,
-    CallMethodKeyword {
-        nargs: Arg<u32>,
-    } = 126,
-    CallMethodEx {
-        has_kwargs: Arg<bool>,
-    } = 127,
     Continue {
         target: Arg<Label>,
     } = 128,
@@ -951,7 +942,7 @@ pub enum Instruction {
         target: Arg<Label>,
     } = 252, // CPython uses pseudo-op 256
     LoadClosure(Arg<NameIdx>) = 253, // CPython uses pseudo-op 258
-    LoadMethod {
+    LoadAttrMethod {
         idx: Arg<NameIdx>,
     } = 254, // CPython uses pseudo-op 259
     PopBlock = 255,                  // CPython uses pseudo-op 263
@@ -972,16 +963,51 @@ impl TryFrom<u8> for Instruction {
 
     #[inline]
     fn try_from(value: u8) -> Result<Self, MarshalError> {
+        // CPython-compatible opcodes (0-118)
         let cpython_start = u8::from(Self::Cache);
         let cpython_end = u8::from(Self::YieldValue { arg: Arg::marker() });
 
+        // Resume has a non-contiguous opcode (149)
         let resume_id = u8::from(Self::Resume { arg: Arg::marker() });
 
-        let custom_start = u8::from(Self::Break {
-            target: Arg::marker(),
-        });
-        let custom_end = u8::from(Self::Subscript);
+        // RustPython-only opcodes (explicit list to avoid gaps like 125-127)
+        let custom_ops: &[u8] = &[
+            u8::from(Self::Break {
+                target: Arg::marker(),
+            }),
+            u8::from(Self::BuildListFromTuples {
+                size: Arg::marker(),
+            }),
+            u8::from(Self::BuildMapForCall {
+                size: Arg::marker(),
+            }),
+            u8::from(Self::BuildSetFromTuples {
+                size: Arg::marker(),
+            }),
+            u8::from(Self::BuildTupleFromIter),
+            u8::from(Self::BuildTupleFromTuples {
+                size: Arg::marker(),
+            }),
+            // 125, 126, 127 are unused
+            u8::from(Self::Continue {
+                target: Arg::marker(),
+            }),
+            u8::from(Self::JumpIfFalseOrPop {
+                target: Arg::marker(),
+            }),
+            u8::from(Self::JumpIfTrueOrPop {
+                target: Arg::marker(),
+            }),
+            u8::from(Self::JumpIfNotExcMatch(Arg::marker())),
+            u8::from(Self::LoadClassDeref(Arg::marker())),
+            u8::from(Self::Reverse {
+                amount: Arg::marker(),
+            }),
+            u8::from(Self::SetExcInfo),
+            u8::from(Self::Subscript),
+        ];
 
+        // Pseudo opcodes (252-255)
         let pseudo_start = u8::from(Self::Jump {
             target: Arg::marker(),
         });
@@ -989,7 +1015,7 @@ impl TryFrom<u8> for Instruction {
 
         if (cpython_start..=cpython_end).contains(&value)
             || value == resume_id
-            || (custom_start..=custom_end).contains(&value)
+            || custom_ops.contains(&value)
             || (pseudo_start..=pseudo_end).contains(&value)
         {
             Ok(unsafe { core::mem::transmute::<u8, Self>(value) })
@@ -1775,6 +1801,8 @@ impl Instruction {
             StoreSubscr => -3,
             DeleteSubscr => -2,
             LoadAttr { .. } => 0,
+            // LoadAttrMethod: pop obj, push method + self_or_null
+            LoadAttrMethod { .. } => 1,
             StoreAttr { .. } => -2,
             DeleteAttr { .. } => -1,
             LoadConst { .. } => 1,
@@ -1808,17 +1836,16 @@ impl Instruction {
                 // pops attribute value and function, pushes function back
                 -2 + 1
             }
-            Call { nargs } => -(nargs.get(arg) as i32) - 1 + 1,
-            CallMethodPositional { nargs } => -(nargs.get(arg) as i32) - 3 + 1,
-            CallKw { nargs } => -1 - (nargs.get(arg) as i32) - 1 + 1,
-            CallMethodKeyword { nargs } => -1 - (nargs.get(arg) as i32) - 3 + 1,
-            CallFunctionEx { has_kwargs } => -1 - (has_kwargs.get(arg) as i32) - 1 + 1,
-            CallMethodEx { has_kwargs } => -1 - (has_kwargs.get(arg) as i32) - 3 + 1,
+            // Call: pops nargs + self_or_null + callable, pushes result
+            Call { nargs } => -(nargs.get(arg) as i32) - 2 + 1,
+            // CallKw: pops kw_names_tuple + nargs + self_or_null + callable, pushes result
+            CallKw { nargs } => -1 - (nargs.get(arg) as i32) - 2 + 1,
+            // CallFunctionEx: pops kwargs(if any) + args_tuple + self_or_null + callable, pushes result
+            CallFunctionEx { has_kwargs } => -1 - (has_kwargs.get(arg) as i32) - 2 + 1,
             CheckEgMatch => 0, // pops 2 (exc, type), pushes 2 (rest, match)
             ConvertValue { .. } => 0,
             FormatSimple => 0,
             FormatWithSpec => -1,
-            LoadMethod { .. } => -1 + 3,
             ForIter { .. } => {
                 if jump {
                     -1
@@ -1909,6 +1936,7 @@ impl Instruction {
             UnaryNegative => 0,
             UnaryNot => 0,
             GetYieldFromIter => 0,
+            PushNull => 1, // Push NULL for call protocol
             _ => 0,
         }
     }
@@ -2001,9 +2029,6 @@ impl Instruction {
             CallKw { nargs } => w!(CALL_KW, nargs),
             CallIntrinsic1 { func } => w!(CALL_INTRINSIC_1, ?func),
             CallIntrinsic2 { func } => w!(CALL_INTRINSIC_2, ?func),
-            CallMethodEx { has_kwargs } => w!(CALL_METHOD_EX, has_kwargs),
-            CallMethodKeyword { nargs } => w!(CALL_METHOD_KW, nargs),
-            CallMethodPositional { nargs } => w!(CALL_METHOD, nargs),
             CheckEgMatch => w!(CHECK_EG_MATCH),
             CheckExcMatch => w!(CHECK_EXC_MATCH),
             CleanupThrow => w!(CLEANUP_THROW),
@@ -2040,6 +2065,7 @@ impl Instruction {
             JumpIfTrueOrPop { target } => w!(JUMP_IF_TRUE_OR_POP, target),
             ListAppend { i } => w!(LIST_APPEND, i),
             LoadAttr { idx } => w!(LOAD_ATTR, name = idx),
+            LoadAttrMethod { idx } => w!(LOAD_ATTR_METHOD, name = idx),
             LoadBuildClass => w!(LOAD_BUILD_CLASS),
             LoadClassDeref(idx) => w!(LOAD_CLASSDEREF, cell_name = idx),
             LoadClosure(i) => w!(LOAD_CLOSURE, cell_name = i),
@@ -2048,7 +2074,6 @@ impl Instruction {
             LoadFast(idx) => w!(LOAD_FAST, varname = idx),
             LoadFastAndClear(idx) => w!(LOAD_FAST_AND_CLEAR, varname = idx),
             LoadGlobal(idx) => w!(LOAD_GLOBAL, name = idx),
-            LoadMethod { idx } => w!(LOAD_METHOD, name = idx),
             LoadName(idx) => w!(LOAD_NAME, name = idx),
             MakeFunction => w!(MAKE_FUNCTION),
             MapAdd { i } => w!(MAP_ADD, i),
@@ -2063,6 +2088,7 @@ impl Instruction {
             PopJumpIfTrue { target } => w!(POP_JUMP_IF_TRUE, target),
             PopTop => w!(POP_TOP),
             PushExcInfo => w!(PUSH_EXC_INFO),
+            PushNull => w!(PUSH_NULL),
             RaiseVarargs { kind } => w!(RAISE_VARARGS, ?kind),
             Reraise { depth } => w!(RERAISE, depth),
             Resume { arg } => w!(RESUME, arg),
diff --git a/crates/jit/src/instructions.rs b/crates/jit/src/instructions.rs
index 4406cf39d4..055528db7f 100644
--- a/crates/jit/src/instructions.rs
+++ b/crates/jit/src/instructions.rs
@@ -27,6 +27,7 @@ enum JitValue {
     Float(Value),
     Bool(Value),
     None,
+    Null,
     Tuple(Vec<JitValue>),
     FuncRef(FuncRef),
 }
@@ -45,14 +46,14 @@ impl JitValue {
             JitValue::Int(_) => Some(JitType::Int),
             JitValue::Float(_) => Some(JitType::Float),
             JitValue::Bool(_) => Some(JitType::Bool),
-            JitValue::None | JitValue::Tuple(_) | JitValue::FuncRef(_) => None,
+            JitValue::None | JitValue::Null | JitValue::Tuple(_) | JitValue::FuncRef(_) => None,
         }
     }
 
     fn into_value(self) -> Option<Value> {
         match self {
             JitValue::Int(val) | JitValue::Float(val) | JitValue::Bool(val) => Some(val),
-            JitValue::None | JitValue::Tuple(_) | JitValue::FuncRef(_) => None,
+            JitValue::None | JitValue::Null | JitValue::Tuple(_) | JitValue::FuncRef(_) => None,
         }
     }
 }
@@ -139,7 +140,9 @@ impl<'a, 'b> FunctionCompiler<'a, 'b> {
             }
             JitValue::Bool(val) => Ok(val),
             JitValue::None => Ok(self.builder.ins().iconst(types::I8, 0)),
-            JitValue::Tuple(_) | JitValue::FuncRef(_) => Err(JitCompileError::NotSupported),
+            JitValue::Null | JitValue::Tuple(_) | JitValue::FuncRef(_) => {
+                Err(JitCompileError::NotSupported)
+            }
         }
     }
 
@@ -463,6 +466,12 @@ impl<'a, 'b> FunctionCompiler<'a, 'b> {
                     args.push(arg.into_value().unwrap());
                 }
 
+                // Pop self_or_null (should be Null for JIT-compiled recursive calls)
+                let self_or_null = self.stack.pop().ok_or(JitCompileError::BadBytecode)?;
+                if !matches!(self_or_null, JitValue::Null) {
+                    return Err(JitCompileError::NotSupported);
+                }
+
                 match self.stack.pop().ok_or(JitCompileError::BadBytecode)? {
                     JitValue::FuncRef(reference) => {
                         let call = self.builder.ins().call(reference, &args);
@@ -474,6 +483,10 @@ impl<'a, 'b> FunctionCompiler<'a, 'b> {
                     _ => Err(JitCompileError::BadBytecode),
                 }
             }
+            Instruction::PushNull => {
+                self.stack.push(JitValue::Null);
+                Ok(())
+            }
             Instruction::CallIntrinsic1 { func } => {
                 match func.get(arg) {
                     IntrinsicFunction1::UnaryPositive => {
diff --git a/crates/stdlib/src/opcode.rs b/crates/stdlib/src/opcode.rs
index 99cc4130b0..1b920822f5 100644
--- a/crates/stdlib/src/opcode.rs
+++ b/crates/stdlib/src/opcode.rs
@@ -74,7 +74,7 @@ mod opcode {
                         | Instruction::ImportName { .. }
                         | Instruction::LoadAttr { .. }
                         | Instruction::LoadGlobal(_)
-                        | Instruction::LoadMethod { .. }
+                        | Instruction::LoadAttrMethod { .. }
                         | Instruction::LoadName(_)
                         | Instruction::StoreAttr { .. }
                         | Instruction::StoreGlobal(_)
diff --git a/crates/vm/src/frame.rs b/crates/vm/src/frame.rs
index 275269c5cb..7e04c900e2 100644
--- a/crates/vm/src/frame.rs
+++ b/crates/vm/src/frame.rs
@@ -53,7 +53,7 @@ enum UnwindReason {
 struct FrameState {
     // We need 1 stack per frame
     /// The main data frame of the stack machine
-    stack: BoxVec<PyObjectRef>,
+    stack: BoxVec<Option<PyObjectRef>>,
     /// index of last instruction ran
     #[cfg(feature = "threading")]
     lasti: u32,
@@ -613,9 +613,8 @@ impl ExecutingFrame<'_> {
             bytecode::Instruction::BinarySubscr => {
                 let key = self.pop_value();
                 let container = self.pop_value();
-                self.state
-                    .stack
-                    .push(container.get_item(key.as_object(), vm)?);
+                let result = container.get_item(key.as_object(), vm)?;
+                self.push_value(result);
                 Ok(None)
             }
 
@@ -676,14 +675,11 @@ impl ExecutingFrame<'_> {
             }
             */
             bytecode::Instruction::BuildString { size } => {
-                let s = self
+                let s: Wtf8Buf = self
                     .pop_multiple(size.get(arg) as usize)
-                    .as_slice()
-                    .iter()
-                    .map(|pyobj| pyobj.downcast_ref::<PyStr>().unwrap())
-                    .collect::<Wtf8Buf>();
-                let str_obj = vm.ctx.new_str(s);
-                self.push_value(str_obj.into());
+                    .map(|pyobj| pyobj.downcast::<PyStr>().unwrap())
+                    .collect();
+                self.push_value(vm.ctx.new_str(s).into());
                 Ok(None)
             }
             bytecode::Instruction::BuildTupleFromIter => {
@@ -707,16 +703,19 @@ impl ExecutingFrame<'_> {
                 self.push_value(list_obj.into());
                 Ok(None)
             }
-            bytecode::Instruction::CallFunctionEx { has_kwargs } => {
-                let args = self.collect_ex_args(vm, has_kwargs.get(arg))?;
+            bytecode::Instruction::Call { nargs } => {
+                // Stack: [callable, self_or_null, arg1, ..., argN]
+                let args = self.collect_positional_args(nargs.get(arg));
                 self.execute_call(args, vm)
             }
             bytecode::Instruction::CallKw { nargs } => {
+                // Stack: [callable, self_or_null, arg1, ..., argN, kwarg_names]
                 let args = self.collect_keyword_args(nargs.get(arg));
                 self.execute_call(args, vm)
             }
-            bytecode::Instruction::Call { nargs } => {
-                let args = self.collect_positional_args(nargs.get(arg));
+            bytecode::Instruction::CallFunctionEx { has_kwargs } => {
+                // Stack: [callable, self_or_null, args_tuple, (kwargs_dict)?]
+                let args = self.collect_ex_args(vm, has_kwargs.get(arg))?;
                 self.execute_call(args, vm)
             }
             bytecode::Instruction::CallIntrinsic1 { func } => {
@@ -732,18 +731,6 @@ impl ExecutingFrame<'_> {
                 self.push_value(result);
                 Ok(None)
             }
-            bytecode::Instruction::CallMethodEx { has_kwargs } => {
-                let args = self.collect_ex_args(vm, has_kwargs.get(arg))?;
-                self.execute_method_call(args, vm)
-            }
-            bytecode::Instruction::CallMethodKeyword { nargs } => {
-                let args = self.collect_keyword_args(nargs.get(arg));
-                self.execute_method_call(args, vm)
-            }
-            bytecode::Instruction::CallMethodPositional { nargs } => {
-                let args = self.collect_positional_args(nargs.get(arg));
-                self.execute_method_call(args, vm)
-            }
             bytecode::Instruction::CheckEgMatch => {
                 let match_type = self.pop_value();
                 let exc_value = self.pop_value();
@@ -788,7 +775,7 @@ impl ExecutingFrame<'_> {
                     panic!("CopyItem: stack underflow");
                 }
                 let value = self.state.stack[stack_len - idx].clone();
-                self.push_value(value);
+                self.push_value_opt(value);
                 Ok(None)
             }
             bytecode::Instruction::DeleteAttr { idx } => self.delete_attr(vm, idx.get(arg)),
@@ -1177,20 +1164,8 @@ impl ExecutingFrame<'_> {
                 self.push_value(x);
                 Ok(None)
             }
-            bytecode::Instruction::LoadMethod { idx } => {
-                let obj = self.pop_value();
-                let method_name = self.code.names[idx.get(arg) as usize];
-                let method = PyMethod::get(obj, method_name, vm)?;
-                let (target, is_method, func) = match method {
-                    PyMethod::Function { target, func } => (target, true, func),
-                    PyMethod::Attribute(val) => (vm.ctx.none(), false, val),
-                };
-                // TODO: figure out a better way to communicate PyMethod::Attribute - CPython uses
-                // target==NULL, maybe we could use a sentinel value or something?
-                self.push_value(target);
-                self.push_value(vm.ctx.new_bool(is_method).into());
-                self.push_value(func);
-                Ok(None)
+            bytecode::Instruction::LoadAttrMethod { idx } => {
+                self.load_attr_method(vm, idx.get(arg))
             }
             bytecode::Instruction::LoadName(idx) => {
                 let name = self.code.names[idx.get(arg) as usize];
@@ -1457,6 +1432,11 @@ impl ExecutingFrame<'_> {
                 self.pop_value();
                 Ok(None)
             }
+            bytecode::Instruction::PushNull => {
+                // Push NULL for self_or_null slot in call protocol
+                self.push_null();
+                Ok(None)
+            }
             bytecode::Instruction::RaiseVarargs { kind } => self.execute_raise(vm, kind.get(arg)),
             bytecode::Instruction::Resume { arg: resume_arg } => {
                 // Resume execution after yield, await, or at function start
@@ -1666,7 +1646,10 @@ impl ExecutingFrame<'_> {
                 let exc = vm.current_exception();
 
                 let stack_len = self.state.stack.len();
-                let exit = self.state.stack[stack_len - 4].clone();
+                let exit = expect_unchecked(
+                    self.state.stack[stack_len - 4].clone(),
+                    "WithExceptStart: __exit__ is NULL",
+                );
 
                 let args = if let Some(ref exc) = exc {
                     vm.split_exception(exc.clone())
@@ -1909,7 +1892,7 @@ impl ExecutingFrame<'_> {
                 {
                     // 1. Pop stack to entry.depth
                     while self.state.stack.len() > entry.depth as usize {
-                        self.pop_value();
+                        self.state.stack.pop();
                     }
 
                     // 2. If push_lasti=true (SETUP_CLEANUP), push lasti before exception
@@ -2132,31 +2115,25 @@ impl ExecutingFrame<'_> {
 
     #[inline]
     fn execute_call(&mut self, args: FuncArgs, vm: &VirtualMachine) -> FrameResult {
-        let func_ref = self.pop_value();
-        let value = func_ref.call(args, vm)?;
-        self.push_value(value);
-        Ok(None)
-    }
-
-    #[inline]
-    fn execute_method_call(&mut self, args: FuncArgs, vm: &VirtualMachine) -> FrameResult {
-        let func = self.pop_value();
-        let is_method = self.pop_value().is(&vm.ctx.true_value);
-        let target = self.pop_value();
-
-        // TODO: It was PyMethod before #4873. Check if it's correct.
-        let func = if is_method {
-            if let Some(descr_get) = func.class().slots.descr_get.load() {
-                let cls = target.class().to_owned().into();
-                descr_get(func, Some(target), Some(cls), vm)?
-            } else {
-                func
+        // Stack: [callable, self_or_null, ...]
+        let self_or_null = self.pop_value_opt(); // Option<PyObjectRef>
+        let callable = self.pop_value();
+
+        // If self_or_null is Some (not NULL), prepend it to args
+        let final_args = if let Some(self_val) = self_or_null {
+            // Method call: prepend self to args
+            let mut all_args = vec![self_val];
+            all_args.extend(args.args);
+            FuncArgs {
+                args: all_args,
+                kwargs: args.kwargs,
             }
         } else {
-            drop(target); // should be None
-            func
+            // Regular attribute call: self_or_null is NULL
+            args
         };
-        let value = func.call(args, vm)?;
+
+        let value = callable.call(final_args, vm)?;
         self.push_value(value);
         Ok(None)
     }
@@ -2253,14 +2230,16 @@ impl ExecutingFrame<'_> {
         // Elements on stack from right-to-left:
         self.state
             .stack
-            .extend(elements.drain(before + middle..).rev());
+            .extend(elements.drain(before + middle..).rev().map(Some));
 
         let middle_elements = elements.drain(before..).collect();
         let t = vm.ctx.new_list(middle_elements);
         self.push_value(t.into());
 
         // Lastly the first reversed values:
-        self.state.stack.extend(elements.into_iter().rev());
+        self.state
+            .stack
+            .extend(elements.into_iter().rev().map(Some));
 
         Ok(None)
     }
@@ -2353,8 +2332,8 @@ impl ExecutingFrame<'_> {
         // Stack: [..., attr_value, func] -> [..., func]
         // Stack order: func is at -1, attr_value is at -2
 
-        let func = self.pop_value();
-        let attr_value = self.replace_top(func);
+        let func = self.pop_value_opt();
+        let attr_value = expect_unchecked(self.replace_top(func), "attr_value must not be null");
 
         let func = self.top_value();
         // Get the function reference and call the new method
@@ -2450,7 +2429,10 @@ impl ExecutingFrame<'_> {
         })?;
         let msg = match elements.len().cmp(&(size as usize)) {
             core::cmp::Ordering::Equal => {
-                self.state.stack.extend(elements.into_iter().rev());
+                // Wrap each element in Some() for Option<PyObjectRef> stack
+                self.state
+                    .stack
+                    .extend(elements.into_iter().rev().map(Some));
                 return Ok(None);
             }
             core::cmp::Ordering::Greater => {
@@ -2511,14 +2493,35 @@ impl ExecutingFrame<'_> {
         Ok(None)
     }
 
-    fn load_attr(&mut self, vm: &VirtualMachine, attr: bytecode::NameIdx) -> FrameResult {
-        let attr_name = self.code.names[attr as usize];
+    fn load_attr(&mut self, vm: &VirtualMachine, idx: u32) -> FrameResult {
+        // Regular attribute access: pop obj, push attr
+        let attr_name = self.code.names[idx as usize];
         let parent = self.pop_value();
         let obj = parent.get_attr(attr_name, vm)?;
         self.push_value(obj);
         Ok(None)
     }
 
+    fn load_attr_method(&mut self, vm: &VirtualMachine, idx: u32) -> FrameResult {
+        // Method call: pop obj, push [method, self_or_null]
+        let attr_name = self.code.names[idx as usize];
+        let parent = self.pop_value();
+
+        match PyMethod::get(parent, attr_name, vm)? {
+            PyMethod::Function { target, func } => {
+                // Method descriptor found: push [method, self]
+                self.push_value(func);
+                self.push_value(target);
+            }
+            PyMethod::Attribute(val) => {
+                // Regular attribute: push [attr, NULL]
+                self.push_value(val);
+                self.push_null();
+            }
+        }
+        Ok(None)
+    }
+
     fn store_attr(&mut self, vm: &VirtualMachine, attr: bytecode::NameIdx) -> FrameResult {
         let attr_name = self.code.names[attr as usize];
         let parent = self.pop_value();
@@ -2537,13 +2540,8 @@ impl ExecutingFrame<'_> {
     // Block stack functions removed - exception table handles all exception/cleanup
 
     #[inline]
-    #[track_caller] // not a real track_caller but push_value is not very useful
-    fn push_value(&mut self, obj: PyObjectRef) {
-        // eprintln!(
-        //     "push_value {} / len: {} +1",
-        //     obj.class().name(),
-        //     self.state.stack.len()
-        // );
+    #[track_caller] // not a real track_caller but push_value is less useful for debugging
+    fn push_value_opt(&mut self, obj: Option<PyObjectRef>) {
         match self.state.stack.try_push(obj) {
             Ok(()) => {}
             Err(_e) => self.fatal("tried to push value onto stack but overflowed max_stackdepth"),
@@ -2551,21 +2549,34 @@ impl ExecutingFrame<'_> {
     }
 
     #[inline]
-    #[track_caller] // not a real track_caller but pop_value is not very useful
-    fn pop_value(&mut self) -> PyObjectRef {
+    #[track_caller]
+    fn push_value(&mut self, obj: PyObjectRef) {
+        self.push_value_opt(Some(obj));
+    }
+
+    #[inline]
+    fn push_null(&mut self) {
+        self.push_value_opt(None);
+    }
+
+    /// Pop a value from the stack, returning None if the stack slot is NULL
+    #[inline]
+    fn pop_value_opt(&mut self) -> Option<PyObjectRef> {
         match self.state.stack.pop() {
-            Some(x) => {
-                // eprintln!(
-                //     "pop_value {} / len: {}",
-                //     x.class().name(),
-                //     self.state.stack.len()
-                // );
-                x
-            }
-            None => self.fatal("tried to pop value but there was nothing on the stack"),
+            Some(slot) => slot, // slot is Option<PyObjectRef>
+            None => self.fatal("tried to pop from empty stack"),
         }
     }
 
+    #[inline]
+    #[track_caller]
+    fn pop_value(&mut self) -> PyObjectRef {
+        expect_unchecked(
+            self.pop_value_opt(),
+            "pop value but null found. This is a compiler bug.",
+        )
+    }
+
     fn call_intrinsic_1(
         &mut self,
         func: bytecode::IntrinsicFunction1,
@@ -2691,7 +2702,8 @@ impl ExecutingFrame<'_> {
         }
     }
 
-    fn pop_multiple(&mut self, count: usize) -> crate::common::boxvec::Drain<'_, PyObjectRef> {
+    /// Pop multiple values from the stack. Panics if any slot is NULL.
+    fn pop_multiple(&mut self, count: usize) -> impl ExactSizeIterator<Item = PyObjectRef> + '_ {
         let stack_len = self.state.stack.len();
         if count > stack_len {
             let instr = self.code.instructions.get(self.lasti() as usize);
@@ -2708,21 +2720,24 @@ impl ExecutingFrame<'_> {
                 self.code.source_path
             );
         }
-        self.state.stack.drain(stack_len - count..)
+        self.state.stack.drain(stack_len - count..).map(|obj| {
+            expect_unchecked(obj, "pop_multiple but null found. This is a compiler bug.")
+        })
     }
 
     #[inline]
-    fn replace_top(&mut self, mut top: PyObjectRef) -> PyObjectRef {
+    fn replace_top(&mut self, mut top: Option<PyObjectRef>) -> Option<PyObjectRef> {
         let last = self.state.stack.last_mut().unwrap();
-        core::mem::swap(&mut top, last);
+        core::mem::swap(last, &mut top);
         top
     }
 
     #[inline]
-    #[track_caller] // not a real track_caller but top_value is not very useful
+    #[track_caller]
     fn top_value(&self) -> &PyObject {
         match &*self.state.stack {
-            [.., last] => last,
+            [.., Some(last)] => last,
+            [.., None] => self.fatal("tried to get top of stack but got NULL"),
             [] => self.fatal("tried to get top of stack but stack is empty"),
         }
     }
@@ -2731,7 +2746,10 @@ impl ExecutingFrame<'_> {
     #[track_caller]
     fn nth_value(&self, depth: u32) -> &PyObject {
         let stack = &self.state.stack;
-        &stack[stack.len() - depth as usize - 1]
+        match &stack[stack.len() - depth as usize - 1] {
+            Some(obj) => obj,
+            None => unsafe { std::hint::unreachable_unchecked() },
+        }
     }
 
     #[cold]
@@ -2746,11 +2764,17 @@ impl ExecutingFrame<'_> {
 impl fmt::Debug for Frame {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let state = self.state.lock();
-        let stack_str = state.stack.iter().fold(String::new(), |mut s, elem| {
-            if elem.downcastable::<Self>() {
-                s.push_str("\n  > {frame}");
-            } else {
-                core::fmt::write(&mut s, format_args!("\n  > {elem:?}")).unwrap();
+        let stack_str = state.stack.iter().fold(String::new(), |mut s, slot| {
+            match slot {
+                Some(elem) if elem.downcastable::<Self>() => {
+                    s.push_str("\n  > {frame}");
+                }
+                Some(elem) => {
+                    core::fmt::write(&mut s, format_args!("\n  > {elem:?}")).unwrap();
+                }
+                None => {
+                    s.push_str("\n  > NULL");
+                }
             }
             s
         });
@@ -2777,3 +2801,11 @@ fn is_module_initializing(module: &PyObject, vm: &VirtualMachine) -> bool {
     };
     initializing_attr.try_to_bool(vm).unwrap_or(false)
 }
+
+fn expect_unchecked(optional: Option<PyObjectRef>, err_msg: &'static str) -> PyObjectRef {
+    if cfg!(debug_assertions) {
+        optional.expect(err_msg)
+    } else {
+        unsafe { optional.unwrap_unchecked() }
+    }
+}
diff --git a/crates/vm/src/vm/method.rs b/crates/vm/src/vm/method.rs
index ba32339148..b964a974c5 100644
--- a/crates/vm/src/vm/method.rs
+++ b/crates/vm/src/vm/method.rs
@@ -3,8 +3,8 @@
 
 use super::VirtualMachine;
 use crate::{
-    builtins::{PyBaseObject, PyStr, PyStrInterned},
-    function::IntoFuncArgs,
+    builtins::{PyBaseObject, PyStr, PyStrInterned, descriptor::PyMethodDescriptor},
+    function::{IntoFuncArgs, PyMethodFlags},
     object::{AsObject, Py, PyObject, PyObjectRef, PyResult},
     types::PyTypeFlags,
 };
@@ -38,8 +38,15 @@ impl PyMethod {
                     .flags
                     .has_feature(PyTypeFlags::METHOD_DESCRIPTOR)
                 {
-                    is_method = true;
-                    None
+                    // For classmethods, we need descr_get to convert instance to class
+                    if let Some(method_descr) = descr.downcast_ref::<PyMethodDescriptor>()
+                        && method_descr.method.flags.contains(PyMethodFlags::CLASS)
+                    {
+                        descr_cls.slots.descr_get.load()
+                    } else {
+                        is_method = true;
+                        None
+                    }
                 } else {
                     let descr_get = descr_cls.slots.descr_get.load();
                     if let Some(descr_get) = descr_get