diff --git a/pkg/image/coverage_more_test.go b/pkg/image/coverage_more_test.go
index 26df4b0..7593e5a 100644
--- a/pkg/image/coverage_more_test.go
+++ b/pkg/image/coverage_more_test.go
@@ -4,6 +4,8 @@ import (
 	"archive/zip"
 	"crypto/sha256"
 	"encoding/hex"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"testing"
@@ -61,3 +63,90 @@ func TestDownloadAndVerifyErrorBranches(t *testing.T) {
 		t.Fatal("expected missing source error")
 	}
 }
+
+func TestDownloadAndVerifyAdditionalErrorBranches(t *testing.T) {
+	dir := t.TempDir()
+	src := filepath.Join(dir, "src.img")
+	if err := os.WriteFile(src, []byte("download-errors"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	blockedParent := filepath.Join(dir, "blocked-parent")
+	if err := os.WriteFile(blockedParent, []byte("not-a-dir"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := DownloadAndVerify("file://"+src, filepath.Join(blockedParent, "out.img"), ""); err == nil {
+		t.Fatal("expected destination parent creation failure")
+	}
+	if _, err := DownloadAndVerify("file://"+filepath.Join(dir, "missing.img.xz"), filepath.Join(dir, "missing-xz.img"), ""); err == nil {
+		t.Fatal("expected missing xz archive source failure")
+	}
+	if _, err := DownloadAndVerify("file://"+filepath.Join(dir, "missing.zip"), filepath.Join(dir, "missing-zip.img"), ""); err == nil {
+		t.Fatal("expected missing zip archive source failure")
+	}
+
+	fakeBin := filepath.Join(dir, "bin")
+	if err := os.MkdirAll(fakeBin, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(fakeBin, "xz"), []byte("#!/usr/bin/env bash\nexit 7\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", fakeBin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	archive := filepath.Join(dir, "bad.img.xz")
+	if err := os.WriteFile(archive, []byte("compressed"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := DownloadAndVerify("file://"+archive, filepath.Join(dir, "xz-out.img"), ""); err == nil {
+		t.Fatal("expected xz decompression failure")
+	}
+	if err := decompressXZ(archive, dir); err == nil {
+		t.Fatal("expected xz destination create failure")
+	}
+
+	invalidZip := filepath.Join(dir, "invalid.zip")
+	if err := os.WriteFile(invalidZip, []byte("not-a-zip"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := DownloadAndVerify("file://"+invalidZip, filepath.Join(dir, "zip-out.img"), ""); err == nil {
+		t.Fatal("expected zip decompression failure")
+	}
+
+	fallbackZip := filepath.Join(dir, "fallback.zip")
+	if err := writeTestZIP(fallbackZip, map[string]string{"readme.txt": "fallback"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := DownloadAndVerify("file://"+fallbackZip, filepath.Join(dir, "fallback.img"), ""); err != nil {
+		t.Fatalf("expected zip fallback file selection to succeed: %v", err)
+	}
+	if err := decompressZIP(fallbackZip, dir); err == nil {
+		t.Fatal("expected zip destination create failure")
+	}
+
+	if err := downloadRaw("file://"+src, dir); err == nil {
+		t.Fatal("expected file destination create failure")
+	}
+	if err := downloadRaw("http://127.0.0.1:1/image.img", filepath.Join(dir, "http.img")); err == nil {
+		t.Fatal("expected HTTP connection failure")
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte("body"))
+	}))
+	defer srv.Close()
+	if err := downloadRaw(srv.URL+"/image.img", dir); err == nil {
+		t.Fatal("expected HTTP destination create failure")
+	}
+
+	if err := VerifyChecksum(filepath.Join(dir, "missing-checksum.img"), "sha256:abc"); err == nil {
+		t.Fatal("expected checksum open failure")
+	}
+	if err := VerifyChecksum(dir, "sha256:abc"); err == nil {
+		t.Fatal("expected sha256 read failure for directory")
+	}
+	if err := VerifyChecksum(dir, "md5:abc"); err == nil {
+		t.Fatal("expected md5 read failure for directory")
+	}
+	if err := VerifyChecksum(src, "sha1:abc"); err == nil {
+		t.Fatal("expected unsupported checksum algorithm")
+	}
+}
diff --git a/pkg/image/rootfs_test.go b/pkg/image/rootfs_test.go
index 2452470..1120cc7 100644
--- a/pkg/image/rootfs_test.go
+++ b/pkg/image/rootfs_test.go
@@ -101,6 +101,218 @@ func TestRootfsErrorBranches(t *testing.T) {
 	}
 }
 
+func TestRootfsAdditionalTopLevelErrorBranches(t *testing.T) {
+	dir := t.TempDir()
+	imagePath := filepath.Join(dir, "image.img")
+	if err := os.WriteFile(imagePath, make([]byte, 1024), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	rootFiles := []inject.FileSpec{{Path: "etc/metis/node.json", Content: []byte("{}"), Mode: 0o600, RootFS: true}}
+
+	t.Run("progress and partition error", func(t *testing.T) {
+		scripts := fakeImageCommandDir(t, map[string]string{"sfdisk": `exit 3`})
+		t.Setenv("PATH", scripts+string(os.PathListSeparator)+os.Getenv("PATH"))
+		var steps []string
+		err := InjectRootFSWithProgress(imagePath, rootFiles, func(step string) {
+			steps = append(steps, step)
+		})
+		if err == nil || len(steps) != 1 || steps[0] != RootFSProgressFindingPartition {
+			t.Fatalf("expected partition error after progress, steps=%v err=%v", steps, err)
+		}
+	})
+
+	t.Run("invalid partition json", func(t *testing.T) {
+		scripts := fakeImageCommandDir(t, map[string]string{"sfdisk": `printf '{bad-json'`})
+		t.Setenv("PATH", scripts+string(os.PathListSeparator)+os.Getenv("PATH"))
+		if _, _, err := findLinuxPartition(imagePath); err == nil {
+			t.Fatal("expected partition JSON decode failure")
+		}
+	})
+
+	t.Run("default sector size", func(t *testing.T) {
+		scripts := fakeImageCommandDir(t, map[string]string{"sfdisk": `cat <<'JSON'
+{"partitiontable":{"sectorsize":0,"partitions":[{"start":1,"size":1,"type":"83"}]}}
+JSON`})
+		t.Setenv("PATH", scripts+string(os.PathListSeparator)+os.Getenv("PATH"))
+		_, sector, err := findLinuxPartition(imagePath)
+		if err != nil || sector != 512 {
+			t.Fatalf("expected default sector size, sector=%d err=%v", sector, err)
+		}
+	})
+
+	t.Run("temp dir failure", func(t *testing.T) {
+		scripts := fakeImageCommandDir(t, map[string]string{"sfdisk": `cat <<'JSON'
+{"partitiontable":{"sectorsize":512,"partitions":[{"start":1,"size":1,"type":"83"}]}}
+JSON`})
+		t.Setenv("PATH", scripts+string(os.PathListSeparator)+os.Getenv("PATH"))
+		tmpFile := filepath.Join(dir, "tmp-file")
+		if err := os.WriteFile(tmpFile, []byte("not-a-dir"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		t.Setenv("TMPDIR", tmpFile)
+		if err := InjectRootFSWithProgress(imagePath, rootFiles, nil); err == nil {
+			t.Fatal("expected rootfs temp-dir failure")
+		}
+	})
+
+	t.Run("extract failure", func(t *testing.T) {
+		shortImage := filepath.Join(dir, "short.img")
+		if err := os.WriteFile(shortImage, make([]byte, 512), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		scripts := fakeImageCommandDir(t, map[string]string{"sfdisk": `cat <<'JSON'
+{"partitiontable":{"sectorsize":512,"partitions":[{"start":1,"size":4,"type":"83"}]}}
+JSON`})
+		t.Setenv("PATH", scripts+string(os.PathListSeparator)+os.Getenv("PATH"))
+		if err := InjectRootFSWithProgress(shortImage, rootFiles, nil); err == nil {
+			t.Fatal("expected partition extraction failure")
+		}
+	})
+
+	t.Run("write files failure", func(t *testing.T) {
+		scripts := fakeImageCommandDir(t, map[string]string{
+			"sfdisk": `cat <<'JSON'
+{"partitiontable":{"sectorsize":512,"partitions":[{"start":1,"size":1,"type":"83"}]}}
+JSON`,
+			"debugfs": `exit 5`,
+		})
+		t.Setenv("PATH", scripts+string(os.PathListSeparator)+os.Getenv("PATH"))
+		if err := InjectRootFSWithProgress(imagePath, rootFiles, nil); err == nil {
+			t.Fatal("expected debugfs write failure")
+		}
+	})
+}
+
+func TestRootfsDirectHelperErrorBranches(t *testing.T) {
+	dir := t.TempDir()
+	part := partitionTablePart{Start: 1, Size: 1}
+	if err := extractPartition(filepath.Join(dir, "missing.img"), filepath.Join(dir, "out.img"), part, 512); err == nil {
+		t.Fatal("expected extract source open failure")
+	}
+
+	srcDir := filepath.Join(dir, "source-dir")
+	if err := os.Mkdir(srcDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := extractPartition(srcDir, filepath.Join(dir, "seek.img"), part, 512); err == nil {
+		t.Fatal("expected extract seek/read failure")
+	}
+
+	src := filepath.Join(dir, "src.img")
+	if err := os.WriteFile(src, make([]byte, 1024), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := extractPartition(src, dir, partitionTablePart{Start: 0, Size: 1}, 512); err == nil {
+		t.Fatal("expected extract destination create failure")
+	}
+
+	if err := replacePartition(src, filepath.Join(dir, "missing-root.img"), partitionTablePart{Start: 0, Size: 1}, 512); err == nil {
+		t.Fatal("expected missing root image failure")
+	}
+	root := filepath.Join(dir, "root.img")
+	if err := os.WriteFile(root, make([]byte, 512), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := replacePartition(filepath.Join(dir, "missing-image.img"), root, partitionTablePart{Start: 0, Size: 1}, 512); err == nil {
+		t.Fatal("expected destination image open failure")
+	}
+	if _, err := os.Stat("/dev/full"); err == nil {
+		if err := replacePartition("/dev/full", root, partitionTablePart{Start: 0, Size: 1}, 512); err == nil {
+			t.Fatal("expected /dev/full replace failure")
+		}
+	}
+
+	tmpFile := filepath.Join(dir, "tmp-file")
+	if err := os.WriteFile(tmpFile, []byte("not-a-dir"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("TMPDIR", tmpFile)
+	if err := writeExt4Files(src, []inject.FileSpec{{Path: "etc/node.json", Content: []byte("{}"), Mode: 0o600, RootFS: true}}); err == nil {
+		t.Fatal("expected writeExt4Files temp-dir failure")
+	}
+}
+
+func TestRootfsWriteAndVerifyErrorBranches(t *testing.T) {
+	dir := t.TempDir()
+	fsPath := filepath.Join(dir, "root.ext4")
+	if err := os.WriteFile(fsPath, make([]byte, 512), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("stage mkdir", func(t *testing.T) {
+		if err := writeExt4Files(fsPath, []inject.FileSpec{{Path: "bad\x00path", Content: []byte("x"), Mode: 0o600, RootFS: true}}); err == nil {
+			t.Fatal("expected stage mkdir failure")
+		}
+	})
+
+	t.Run("debugfs write", func(t *testing.T) {
+		scripts := fakeImageCommandDir(t, map[string]string{"debugfs": `exit 6`})
+		t.Setenv("PATH", scripts+string(os.PathListSeparator)+os.Getenv("PATH"))
+		if err := writeExt4Files(fsPath, []inject.FileSpec{{Path: "etc/node.json", Content: []byte("{}"), Mode: 0o600, RootFS: true}}); err == nil {
+			t.Fatal("expected debugfs write failure")
+		}
+	})
+
+	t.Run("verify stat", func(t *testing.T) {
+		scripts := fakeImageCommandDir(t, map[string]string{"debugfs": `exit 7`})
+		t.Setenv("PATH", scripts+string(os.PathListSeparator)+os.Getenv("PATH"))
+		if err := verifyExt4File(fsPath, inject.FileSpec{Path: "etc/node.json", Content: []byte("{}"), Mode: 0o600}, t.TempDir()); err == nil {
+			t.Fatal("expected debugfs stat failure")
+		}
+	})
+
+	t.Run("verify mode", func(t *testing.T) {
+		scripts := fakeImageCommandDir(t, map[string]string{"debugfs": `printf 'Mode:  0644\n'`})
+		t.Setenv("PATH", scripts+string(os.PathListSeparator)+os.Getenv("PATH"))
+		if err := verifyExt4File(fsPath, inject.FileSpec{Path: "etc/node.json", Content: []byte("{}"), Mode: 0o600}, t.TempDir()); err == nil {
+			t.Fatal("expected mode mismatch")
+		}
+	})
+
+	t.Run("readback mkdir", func(t *testing.T) {
+		scripts := fakeImageCommandDir(t, map[string]string{"debugfs": `printf 'Mode:  0600\n'`})
+		t.Setenv("PATH", scripts+string(os.PathListSeparator)+os.Getenv("PATH"))
+		workDir := t.TempDir()
+		if err := os.WriteFile(filepath.Join(workDir, "etc"), []byte("not-a-dir"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		if err := verifyExt4File(fsPath, inject.FileSpec{Path: "etc/node.json", Content: []byte("{}"), Mode: 0o600}, workDir); err == nil {
+			t.Fatal("expected readback mkdir failure")
+		}
+	})
+
+	t.Run("dump failure", func(t *testing.T) {
+		scripts := fakeImageCommandDir(t, map[string]string{"debugfs": `set -- ${2:-}
+if [[ "${1:-}" == "stat" ]]; then printf 'Mode:  0600\n'; exit 0; fi
+exit 8`})
+		t.Setenv("PATH", scripts+string(os.PathListSeparator)+os.Getenv("PATH"))
+		if err := verifyExt4File(fsPath, inject.FileSpec{Path: "etc/node.json", Content: []byte("{}"), Mode: 0o600}, t.TempDir()); err == nil {
+			t.Fatal("expected dump failure")
+		}
+	})
+
+	t.Run("readback missing", func(t *testing.T) {
+		scripts := fakeImageCommandDir(t, map[string]string{"debugfs": `set -- ${2:-}
+if [[ "${1:-}" == "stat" ]]; then printf 'Mode:  0600\n'; exit 0; fi
+exit 0`})
+		t.Setenv("PATH", scripts+string(os.PathListSeparator)+os.Getenv("PATH"))
+		if err := verifyExt4File(fsPath, inject.FileSpec{Path: "etc/node.json", Content: []byte("{}"), Mode: 0o600}, t.TempDir()); err == nil {
+			t.Fatal("expected missing readback file")
+		}
+	})
+
+	t.Run("content mismatch", func(t *testing.T) {
+		scripts := fakeImageCommandDir(t, map[string]string{"debugfs": `set -- ${2:-}
+if [[ "${1:-}" == "stat" ]]; then printf 'Mode:  0600\n'; exit 0; fi
+if [[ "${1:-}" == "dump" ]]; then printf 'wrong' > "${3:-}"; exit 0; fi
+exit 0`})
+		t.Setenv("PATH", scripts+string(os.PathListSeparator)+os.Getenv("PATH"))
+		if err := verifyExt4File(fsPath, inject.FileSpec{Path: "etc/node.json", Content: []byte("{}"), Mode: 0o600}, t.TempDir()); err == nil {
+			t.Fatal("expected content mismatch")
+		}
+	})
+}
+
 func fakeRootfsCommands(t *testing.T, includeLinux bool) string {
 	t.Helper()
 	dir := t.TempDir()
@@ -141,3 +353,15 @@ fi
 exit 0`)
 	return dir
 }
+
+func fakeImageCommandDir(t *testing.T, scripts map[string]string) string {
+	t.Helper()
+	dir := t.TempDir()
+	for name, body := range scripts {
+		path := filepath.Join(dir, name)
+		if err := os.WriteFile(path, []byte("#!/usr/bin/env bash\nset -eu\n"+body+"\n"), 0o755); err != nil {
+			t.Fatalf("write %s: %v", name, err)
+		}
+	}
+	return dir
+}