diff --git a/linux/build/scripts/diagnose-divergence.sh b/linux/build/scripts/diagnose-divergence.sh
index d98c78b..2092a09 100755
--- a/linux/build/scripts/diagnose-divergence.sh
+++ b/linux/build/scripts/diagnose-divergence.sh
@@ -126,12 +126,15 @@ extract_squashfs() {
     if ! command -v xorriso >/dev/null 2>&1; then return 1; fi
 
     # Try canonical Debian/Kicksecure layout first.
+    local err_log; err_log=$(mktemp)
     for path in /live/filesystem.squashfs /casper/filesystem.squashfs \
                 /filesystem.squashfs /install/filesystem.squashfs \
                 /boot/filesystem.squashfs ; do
-        if xorriso -indev "${iso}" -extract "${path}" "${out}" 2>/dev/null \
+        if xorriso -osirrox on -indev "${iso}" -extract "${path}" "${out}" \
+                2>"${err_log}" \
             && [[ -s "${out}" ]]; then
             echo "diagnose: extracted ${path} from $(basename "${iso}")" >&2
+            rm -f "${err_log}"
             return 0
         fi
     done
@@ -143,11 +146,17 @@ extract_squashfs() {
     biggest=$(biggest_file "${iso}")
     if [[ -n "${biggest}" ]]; then
         echo "diagnose: largest file in $(basename "${iso}") is ${biggest}; extracting" >&2
-        if xorriso -indev "${iso}" -extract "${biggest}" "${out}" 2>/dev/null \
+        if xorriso -osirrox on -indev "${iso}" -extract "${biggest}" "${out}" \
+                2>"${err_log}" \
             && [[ -s "${out}" ]]; then
+            rm -f "${err_log}"
             return 0
         fi
     fi
+    # If we got here, extraction failed; surface the error.
+    echo "diagnose: xorriso -extract stderr (last 30 lines):" >&2
+    tail -n 30 "${err_log}" >&2 || true
+    rm -f "${err_log}"
     return 1
 }