diff --git a/src/syscall/fs.rs b/src/syscall/fs.rs
index 450a25a184..432a966eeb 100644
--- a/src/syscall/fs.rs
+++ b/src/syscall/fs.rs
@@ -90,6 +90,7 @@ pub fn openat(
     let new_description = {
         let scheme = scheme::get_scheme(token.token(), scheme_id)?;
 
+        let dbg_uid = caller_ctx.uid;
         let res = scheme.kopenat(
             number,
             StrOrBytes::from_str(&path_buf),
@@ -99,6 +100,24 @@ pub fn openat(
             token,
         );
 
+        // Red Bear diagnostic (2026-07-15): log non-ENOENT open failures to
+        // trace getty's EACCES on /scheme/rand and redoxfs's pipe open failure.
+        if let Err(ref e) = res {
+            if e.errno != ENOENT {
+                let pid = context::current().read(token.token()).pid;
+                error!(
+                    "openat_err: pid={} base_scheme={} base_number={} path={:?} flags={:#x} uid={} errno={}",
+                    pid,
+                    scheme_id.get(),
+                    number,
+                    path_buf.as_str(),
+                    flags,
+                    dbg_uid,
+                    e.errno
+                );
+            }
+        }
+
         match res? {
             OpenResult::SchemeLocal(number, internal_flags) => {
                 FileDescriptor {
@@ -148,9 +167,20 @@ pub fn openat_into(
         (desc.scheme, desc.number)
     };
     let caller_ctx = context::current().read(token.token()).caller_ctx();
+    let dbg_uid = caller_ctx.uid;
     let new_description = {
         let scheme = scheme::get_scheme(token.token(), scheme_id)?;
-        let res = scheme.kopenat(number, StrOrBytes::from_str(&path_buf), flags, fcntl_flags, caller_ctx, token)?;
+        let res0 = scheme.kopenat(number, StrOrBytes::from_str(&path_buf), flags, fcntl_flags, caller_ctx, token);
+        if let Err(ref e) = res0 {
+            if e.errno != ENOENT {
+                let pid = context::current().read(token.token()).pid;
+                error!(
+                    "openat_into_err: pid={} base_scheme={} base_number={} path={:?} flags={:#x} uid={} errno={}",
+                    pid, scheme_id.get(), number, path_buf.as_str(), flags, dbg_uid, e.errno
+                );
+            }
+        }
+        let res = res0?;
         match res {
             OpenResult::SchemeLocal(number, internal_flags) => {
                 FileDescriptor {