diff --git a/native/jni/su/pts.cpp b/native/jni/su/pts.cpp
index 3e0af3b42..fc1ee85a2 100644
--- a/native/jni/su/pts.cpp
+++ b/native/jni/su/pts.cpp
@@ -108,6 +108,7 @@ error:
 int get_pty_num(int fd) {
     int pty_num = -1;
     if (ioctl(fd, TIOCGPTN, &pty_num) != 0) {
+        LOGW("get_pty_num failed with %d: %s\n", errno, std::strerror(errno));
         return -1;
     }
     return pty_num;
diff --git a/native/jni/su/su_daemon.cpp b/native/jni/su/su_daemon.cpp
index 6861a1b54..4e5610867 100644
--- a/native/jni/su/su_daemon.cpp
+++ b/native/jni/su/su_daemon.cpp
@@ -240,10 +240,19 @@ void su_daemon_handler(int client, const sock_cred *cred) {
             ptmx = magiskpts + "/ptmx";
         }
         int ptmx_fd = xopen(ptmx.data(), O_RDWR);
-        int unlock = 0;
-        ioctl(ptmx_fd, TIOCSPTLCK, &unlock);
-        send_fd(client, ptmx_fd);
+        grantpt(ptmx_fd);
+        unlockpt(ptmx_fd);
         int pty_num = get_pty_num(ptmx_fd);
+        if (pty_num < 0) {
+            // Kernel issue? Fallback to /dev/pts
+            close(ptmx_fd);
+            pts = "/dev/pts";
+            ptmx_fd = xopen("/dev/ptmx", O_RDWR);
+            grantpt(ptmx_fd);
+            unlockpt(ptmx_fd);
+            pty_num = get_pty_num(ptmx_fd);
+        }
+        send_fd(client, ptmx_fd);
         close(ptmx_fd);
 
         string pts_slave = pts + "/" + to_string(pty_num);