--- a/sys/ddb/db_input.c
+++ b/sys/ddb/db_input.c
@@ -63,6 +63,15 @@
 #define	BLANK		' '
 #define	BACKUP		'\b'
 
+/*
+ * DF-harness guest-only test instrumentation (NOT a fix).
+ *
+ * Console-input injection hook so kernel tests can drive the real
+ * db_readline()/db_read_line() path (and, through it, the DDB lexer)
+ * with a fabricated input stream instead of a physical console.
+ */
+int (*df_dbinput_getc)(void) = NULL;
+
 static int	cnmaygetc (void);
 static void	db_delete (int n, int bwd);
 static int	db_inputchar (int c);
@@ -310,7 +319,8 @@
 	db_lc = lstart;
 	db_le = lstart;
 
-	while (!db_inputchar(cngetc()))
+	while (!db_inputchar(df_dbinput_getc != NULL ? df_dbinput_getc() :
+	    cngetc()))
 	    continue;
 
 	db_printf("\n");	/* synch output position */
--- a/sys/libprop/prop_dictionary.c
+++ b/sys/libprop/prop_dictionary.c
@@ -215,6 +215,56 @@
 	return 0;
 }
 
+/*
+ * DF-2225 harness hooks (guest-only test instrumentation, NOT a fix).
+ *
+ * These expose the file-local once/tree/mutex state so the dfharness
+ * test file can (a) observe the once flag, (b) reproduce the exact
+ * intermediate state a _PROP_ONCE_RUN winner is in between its
+ * atomic_cmpset_int(0 -> 1) and the completion of f() (tree + mutex
+ * still zero-initialized as at boot), and (c) emulate what a FIXED
+ * two-phase once macro would do after f() completes.
+ */
+int	df2225_once_val(void);
+void	df2225_state_reset(void);
+void	df2225_arm_window(void);
+void	df2225_complete_init(void);
+
+int
+df2225_once_val(void)
+{
+
+	return (_prop_dict_init_once);
+}
+
+void
+df2225_state_reset(void)
+{
+
+	_prop_dict_init_once = 0;
+	memset(&_prop_dict_keysym_tree, 0, sizeof(_prop_dict_keysym_tree));
+	memset(&_prop_dict_keysym_tree_mutex, 0,
+	    sizeof(_prop_dict_keysym_tree_mutex));
+}
+
+void
+df2225_arm_window(void)
+{
+
+	df2225_state_reset();
+	/* exactly the winner's state right after the cmpset, before f() */
+	atomic_cmpset_int(&_prop_dict_init_once, 0, 1);
+}
+
+void
+df2225_complete_init(void)
+{
+
+	/* what a FIXED _PROP_ONCE_RUN winner does once f() returns */
+	_prop_dict_init();
+	atomic_store_rel_int(&_prop_dict_init_once, 2);
+}
+
 static void
 _prop_dict_keysym_put(prop_dictionary_keysym_t pdk)
 {