diff --git a/tests/fs/union/t_pr.c b/tests/fs/union/t_pr.c
index 9603a4c84cfc..1dbf0a6bc7c7 100644
--- a/tests/fs/union/t_pr.c
+++ b/tests/fs/union/t_pr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: t_pr.c,v 1.3 2010/07/03 08:18:30 jmmv Exp $	*/
+/*	$NetBSD: t_pr.c,v 1.4 2010/07/03 12:08:37 pooka Exp $	*/
 
 #include <sys/types.h>
 #include <sys/mount.h>
@@ -71,9 +71,74 @@ ATF_TC_BODY(multilayer, tc)
 	rump_sys_mount(MOUNT_UNION, "/Tunion", 0,&unionargs,sizeof(unionargs));
 }
 
+ATF_TC(devnull1);
+ATF_TC_HEAD(devnull1, tc)
+{
+	atf_tc_set_md_var(tc, "descr", "mount_union -b and "
+	    "'echo x > /un/null'");
+}
+
+ATF_TC_BODY(devnull1, tc)
+{
+	struct union_args unionargs;
+	int fd;
+
+	rump_init();
+
+	if (rump_sys_mkdir("/mp", 0777) == -1)
+		atf_tc_fail_errno("mkdir mp");
+
+	unionargs.target = __UNCONST("/dev");
+	unionargs.mntflags = UNMNT_BELOW;
+
+	if (rump_sys_mount(MOUNT_UNION, "/mp", 0,
+	    &unionargs, sizeof(unionargs)) == -1)
+		atf_tc_fail_errno("union mount");
+
+	fd = rump_sys_open("/mp/null", O_WRONLY | O_CREAT | O_TRUNC);
+
+	atf_tc_expect_fail("PR kern/43560");
+	if (fd == -1)
+		atf_tc_fail_errno("open");
+}
+
+ATF_TC(devnull2);
+ATF_TC_HEAD(devnull2, tc)
+{
+	atf_tc_set_md_var(tc, "descr", "mount_union -b and "
+	    "'echo x >> /un/null'");
+}
+
+ATF_TC_BODY(devnull2, tc)
+{
+	struct union_args unionargs;
+	int fd;
+
+	rump_init();
+
+	if (rump_sys_mkdir("/mp", 0777) == -1)
+		atf_tc_fail_errno("mkdir mp");
+
+	unionargs.target = __UNCONST("/dev");
+	unionargs.mntflags = UNMNT_BELOW;
+
+	if (rump_sys_mount(MOUNT_UNION, "/mp", 0,
+	    &unionargs, sizeof(unionargs)) == -1)
+		atf_tc_fail_errno("union mount");
+
+	fd = rump_sys_open("/mp/null", O_WRONLY | O_CREAT | O_APPEND);
+	if (fd == -1)
+		atf_tc_fail_errno("open");
+
+	atf_tc_expect_signal(-1, "PR kern/43560");
+	rump_sys_write(fd, &fd, sizeof(fd));
+}
+
 ATF_TP_ADD_TCS(tp)
 {
 	ATF_TP_ADD_TC(tp, multilayer);
+	ATF_TP_ADD_TC(tp, devnull1);
+	ATF_TP_ADD_TC(tp, devnull2);
 
 	return atf_no_error();
 }