--- a/sys/vfs/hammer2/hammer2_io.c
+++ b/sys/vfs/hammer2/hammer2_io.c
@@ -33,6 +33,16 @@
  */
 
 #include "hammer2.h"
+#include <sys/sysctl.h>
+
+SYSCTL_DECL(_vfs_hammer2);
+
+/* DF-2661 fault injection: fail next N inode-data breads with EIO.
+ * ENVIRONMENT SIMULATION ONLY (dying media) -- never part of a fix. */
+int hammer2_df2661_fail_inode_read = 0;
+SYSCTL_INT(_vfs_hammer2, OID_AUTO, df2661_fail_inode_read, CTLFLAG_RW,
+	   &hammer2_df2661_fail_inode_read, 0,
+	   "FAULT-INJECT fail next N inode block reads with EIO");
 
 #define HAMMER2_DOP_READ	1
 #define HAMMER2_DOP_NEW		2
@@ -353,6 +363,14 @@
 		dio->bp->b_flags &= ~B_AGE;
 		/* dio->bp->b_debug_info2 = dio; */
 	}
+	if (hammer2_df2661_fail_inode_read > 0 &&
+	    btype == HAMMER2_BREF_TYPE_INODE &&
+	    hmp->voldata.volu_size == 0x20000000ULL) {
+		/* DF-2661 fault injection: only the 512MB test volume,
+		 * never the guest root fs */
+		--hammer2_df2661_fail_inode_read;
+		error = EIO;
+	}
 	dio->error = error;
 
 	/*