--- src-b10b3/drivers/power/supply/Kconfig	2026-09-21 19:09:00.000000000 +0600
+++ src-b10b5/drivers/power/supply/Kconfig	2026-10-04 20:08:07.140000000 +0600
@@ -768,6 +768,16 @@
 	  To compile this driver as module, choose M here: the
 	  module will be called pm8916_lbc.
 
+config CHARGER_PM8916_LBC_B10B5_TEST
+	bool "Aurora B10B-5 TEST-ONLY FAULT injection debugfs"
+	depends on CHARGER_PM8916_LBC && DEBUG_FS
+	default n
+	help
+	  TEST-ONLY (Aurora B10B-5 RAM regression). Adds the write-only debugfs file
+	  pm8916_lbc/b10b5_fault; writing "ovp" makes the next supervisor fault check
+	  take the production OVP FAULT path (FAULT safe clamp) without a real OVP.
+	  Never enable in a production image.
+
 config CHARGER_BQ2415X
 	tristate "TI BQ2415x battery charger driver"
 	depends on I2C
--- /tmp/v4.c	2026-10-04 20:08:07.092000000 +0600
+++ src-b10b5/drivers/power/supply/pm8916_lbc.c	2026-10-04 20:08:07.140000000 +0600
@@ -20,6 +20,11 @@
 #include <linux/of.h>
 #include <linux/seq_file.h>
 #include <linux/workqueue.h>
+#ifdef CONFIG_CHARGER_PM8916_LBC_B10B5_TEST
+#include <linux/fs.h>
+#include <linux/string.h>
+#include <linux/uaccess.h>
+#endif
 
 /* Two bytes: type + subtype */
 #define PM8916_PERPH_TYPE 0x04
@@ -103,6 +108,9 @@
 	struct mutex supv_lock;
 	int state;
 	int fault_reason;
+#ifdef CONFIG_CHARGER_PM8916_LBC_B10B5_TEST
+	bool test_fault_ovp;	/* B10B-5 TEST-ONLY one-shot OVP injection */
+#endif
 	unsigned int hold_uv;		/* aurora,hold-voltage-microvolt, 0 = HOLD disabled */
 	unsigned int full_min_uv;	/* aurora,full-min-voltage-microvolt */
 	unsigned int cv_hold_min;	/* aurora,cv-hold-minutes */
@@ -427,6 +435,12 @@
 		return lbc_enter_fault(chg, LBC_FAULT_TIMER, "CHG_FAILED (safety timer)");
 	if (chg->vbat_uv > PM8916_LBC_SUPV_OVP_UV)
 		return lbc_enter_fault(chg, LBC_FAULT_OVP, "vbat > 4.25 V");
+#ifdef CONFIG_CHARGER_PM8916_LBC_B10B5_TEST
+	if (chg->test_fault_ovp) {
+		chg->test_fault_ovp = false;
+		return lbc_enter_fault(chg, LBC_FAULT_OVP, "TEST-injected OVP (B10B-5)");
+	}
+#endif
 	return false;
 }
 
@@ -565,6 +579,36 @@
 }
 DEFINE_SHOW_ATTRIBUTE(lbc_state);
 
+#ifdef CONFIG_CHARGER_PM8916_LBC_B10B5_TEST
+/* B10B-5 TEST-ONLY: "ovp" arms a one-shot OVP condition for the next supervisor fault check (production FAULT path). */
+static ssize_t lbc_b10b5_fault_write(struct file *file, const char __user *ubuf, size_t len, loff_t *ppos)
+{
+	struct pm8916_lbc_charger *chg = file->private_data;
+	char buf[8];
+
+	if (len == 0 || len >= sizeof(buf))
+		return -EINVAL;
+	if (copy_from_user(buf, ubuf, len))
+		return -EFAULT;
+	buf[len] = 0;
+	if (strcmp(strim(buf), "ovp"))
+		return -EINVAL;
+	mutex_lock(&chg->supv_lock);
+	chg->test_fault_ovp = true;
+	mutex_unlock(&chg->supv_lock);
+	dev_warn(chg->dev, "B10B-5 TEST: OVP FAULT injection armed (state %s)\n", lbc_state_name[chg->state]);
+	mod_delayed_work(system_freezable_wq, &chg->supv_work, 0);
+	return len;
+}
+
+static const struct file_operations lbc_b10b5_fault_fops = {
+	.owner = THIS_MODULE,
+	.open = simple_open,
+	.write = lbc_b10b5_fault_write,
+	.llseek = noop_llseek,
+};
+#endif
+
 static void lbc_debugfs_remove(void *data)
 {
 	debugfs_remove_recursive(data);
@@ -792,6 +836,10 @@
 
 	chg->debugfs = debugfs_create_dir("pm8916_lbc", NULL);
 	debugfs_create_file("state", 0444, chg->debugfs, chg, &lbc_state_fops);
+#ifdef CONFIG_CHARGER_PM8916_LBC_B10B5_TEST
+	debugfs_create_file("b10b5_fault", 0200, chg->debugfs, chg, &lbc_b10b5_fault_fops);
+	dev_warn(dev, "B10B-5 TEST-ONLY FAULT injection enabled (debugfs pm8916_lbc/b10b5_fault) - never in production\n");
+#endif
 	ret = devm_add_action_or_reset(dev, lbc_debugfs_remove, chg->debugfs);
 	if (ret)
 		return ret;