--- a/sys/vfs/hammer/hammer_vfsops.c
+++ b/sys/vfs/hammer/hammer_vfsops.c
@@ -683,6 +683,23 @@
 	}
 
 	/*
+	 * DF-3095: vol0_next_tid is media data and hammer_alloc_tid()
+	 * has no wrap handling - it can only hpanic("Ran out of TIDs!").
+	 * With master_id >= 0 the 16-alignment addition can wrap the
+	 * counter all the way back to 0; TIDs issued after the wrap
+	 * sort before every existing record in the btree (create_tid
+	 * comparison), silently injecting new records into every
+	 * historical snapshot/asof view of the filesystem.  Reject
+	 * exhausted or wrap-capable values at mount time.
+	 */
+	if (rootvol->ondisk->vol0_next_tid >= 0xFFFFFFFFFF000000ULL) {
+		hkprintf("mount rejected vol0_next_tid %016jx\n",
+			 (uintmax_t)rootvol->ondisk->vol0_next_tid);
+		error = ERANGE;
+		goto done;
+	}
+
+	/*
 	 * The undo_rec_limit limits the size of flush groups to avoid
 	 * blowing out the UNDO FIFO.  This calculation is typically in
 	 * the tens of thousands and is designed primarily when small