--- a/sys/kern/kern_slaballoc.c
+++ b/sys/kern/kern_slaballoc.c
@@ -806,6 +806,10 @@
 /* don't let kmalloc macro mess up function declaration */
 #undef kmalloc
 
+/* NGDPOC (DF-2573 verification) fault-injection knobs -- kern/df_ngdpoc.c */
+extern int ngdpoc_kmalloc_fail_armed;
+extern unsigned long ngdpoc_kmalloc_fail_size;
+
 #ifdef SLAB_DEBUG
 void *
 _kmalloc_debug(unsigned long size, struct malloc_type *type, int flags,
@@ -825,6 +829,16 @@
     int i;
 #endif
 
+    /* NGDPOC (DF-2573 verification): one-shot scoped fault injection.
+     * Armed and consumed within a single kern.ngdpoc.trigger sysctl call;
+     * fires only for the exact (size, M_DEVBUF) pair requested. */
+    if (__predict_false(ngdpoc_kmalloc_fail_armed != 0) &&
+	size == ngdpoc_kmalloc_fail_size && type == M_DEVBUF) {
+	ngdpoc_kmalloc_fail_armed = 0;
+	kprintf("NGDPOC: injected kmalloc(%lu, M_DEVBUF) failure\n", size);
+	return (NULL);
+    }
+
     logmemory_quick(malloc_beg);
     gd = mycpu;
     slgd = &gd->gd_slab;