diff --git a/crypto/x509/policy.c b/crypto/x509/policy.c
index 5f9fe9c..393cb84 100644
--- a/crypto/x509/policy.c
+++ b/crypto/x509/policy.c
@@ -563,7 +563,7 @@
     }
     int ok =
         apply_skip_certs(constraints->requireExplicitPolicy, explicit_policy) &&
-        apply_skip_certs(constraints->inhibitPolicyMapping, inhibit_any_policy);
+        apply_skip_certs(constraints->inhibitPolicyMapping, policy_mapping);
     POLICY_CONSTRAINTS_free(constraints);
     if (!ok) {
       return 0;
diff --git a/crypto/x509/test/make_policy_certs.go b/crypto/x509/test/make_policy_certs.go
index 8d3a11d..c57d973 100644
--- a/crypto/x509/test/make_policy_certs.go
+++ b/crypto/x509/test/make_policy_certs.go
@@ -103,6 +103,20 @@
 		panic(err)
 	}
 
+	root2 := templateAndKey{
+		template: x509.Certificate{
+			SerialNumber:          new(big.Int).SetInt64(1),
+			Subject:               pkix.Name{CommonName: "Policy Root 2"},
+			NotBefore:             notBefore,
+			NotAfter:              notAfter,
+			BasicConstraintsValid: true,
+			IsCA:                  true,
+			ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+			KeyUsage:              x509.KeyUsageCertSign,
+			SignatureAlgorithm:    x509.ECDSAWithSHA256,
+		},
+		key: rootKey,
+	}
 	root := templateAndKey{
 		template: x509.Certificate{
 			SerialNumber:          new(big.Int).SetInt64(1),
@@ -154,6 +168,10 @@
 	mustGenerateCertificate("policy_intermediate.pem", &intermediate, &root)
 	mustGenerateCertificate("policy_leaf.pem", &leaf, &intermediate)
 
+	// root2 is used for tests that need a longer chain, using a Root/Root2
+	// cross-sign as one of the certificates.
+	mustGenerateCertificate("policy_root2.pem", &root2, &root2)
+
 	// Introduce syntax errors in the leaf and intermediate.
 	leafInvalid := leaf
 	leafInvalid.template.PolicyIdentifiers = nil
@@ -284,9 +302,18 @@
 	leafSingle.template.PolicyIdentifiers = []asn1.ObjectIdentifier{testOID5}
 	mustGenerateCertificate("policy_leaf_oid5.pem", &leafSingle, &intermediate)
 
-	// TODO(davidben): Generate more certificates to test policy validation more
-	// extensively, including an intermediate with constraints. For now this
-	// just tests the basic case.
+	// Make version of Root, signed by Root 2, with policy mapping inhibited.
+	// This can be combined with intermediateMapped to test the combination.
+	b = cryptobyte.NewBuilder(nil)
+	b.AddASN1(cbasn1.SEQUENCE, func(seq *cryptobyte.Builder) {
+		seq.AddASN1Int64WithTag(0, cbasn1.Tag(1).ContextSpecific())
+	})
+	inhibitPolicyMapping0 := b.BytesOrPanic()
+
+	inhibitMapping := root
+	inhibitMapping.template.PolicyIdentifiers = []asn1.ObjectIdentifier{anyPolicyOID}
+	inhibitMapping.template.ExtraExtensions = []pkix.Extension{{Id: policyConstraintsOID, Value: inhibitPolicyMapping0}}
+	mustGenerateCertificate("policy_root_cross_inhibit_mapping.pem", &inhibitMapping, &root2)
 }
 
 const leafKeyPEM = `-----BEGIN PRIVATE KEY-----
diff --git a/crypto/x509/test/policy_root2.pem b/crypto/x509/test/policy_root2.pem
new file mode 100644
index 0000000..1350035
--- /dev/null
+++ b/crypto/x509/test/policy_root2.pem
@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBeDCCAR6gAwIBAgIBATAKBggqhkjOPQQDAjAYMRYwFAYDVQQDEw1Qb2xpY3kg
+Um9vdCAyMCAXDTAwMDEwMTAwMDAwMFoYDzIxMDAwMTAxMDAwMDAwWjAYMRYwFAYD
+VQQDEw1Qb2xpY3kgUm9vdCAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJnal
+2JdRr2O8t43E0yujFVyEK+OE6goUWCOiHlfbSAeoyLDmPkKJdW5PMf+wORRjp1Fh
+VSxADxD0icD53Y6JbaNXMFUwDgYDVR0PAQH/BAQDAgIEMBMGA1UdJQQMMAoGCCsG
+AQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFNBp56Afsnjet1jLYZ4e
+lIdRx3USMAoGCCqGSM49BAMCA0gAMEUCIQDm9rw9ODVtJUPBn2lWoK8s7ElbyY4/
+Gc2thHR50UUzbgIgKRenEDhKiBR6cGC77RaIiaaafW8b7HMd7obuZdDU/58=
+-----END CERTIFICATE-----
diff --git a/crypto/x509/test/policy_root_cross_inhibit_mapping.pem b/crypto/x509/test/policy_root_cross_inhibit_mapping.pem
new file mode 100644
index 0000000..9273a53
--- /dev/null
+++ b/crypto/x509/test/policy_root_cross_inhibit_mapping.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBljCCAT2gAwIBAgIBATAKBggqhkjOPQQDAjAYMRYwFAYDVQQDEw1Qb2xpY3kg
+Um9vdCAyMCAXDTAwMDEwMTAwMDAwMFoYDzIxMDAwMTAxMDAwMDAwWjAWMRQwEgYD
+VQQDEwtQb2xpY3kgUm9vdDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCZ2pdiX
+Ua9jvLeNxNMroxVchCvjhOoKFFgjoh5X20gHqMiw5j5CiXVuTzH/sDkUY6dRYVUs
+QA8Q9InA+d2OiW2jeDB2MA4GA1UdDwEB/wQEAwICBDATBgNVHSUEDDAKBggrBgEF
+BQcDATAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTQaeegH7J43rdYy2GeHpSH
+Ucd1EjARBgNVHSAECjAIMAYGBFUdIAAwDAYDVR0kBAUwA4EBADAKBggqhkjOPQQD
+AgNHADBEAiBzR3JGEf9PITYuiXTx+vx9gXji5idGsVog9wRUbY98wwIgVVeYNQQb
+x+RN2wYp3kmm8iswUOrqiI6J4PSzT8CYP8Q=
+-----END CERTIFICATE-----
diff --git a/crypto/x509/x509_test.cc b/crypto/x509/x509_test.cc
index e4af13e..32b2483 100644
--- a/crypto/x509/x509_test.cc
+++ b/crypto/x509/x509_test.cc
@@ -5115,6 +5115,13 @@
   bssl::UniquePtr<X509> root(
       CertFromPEM(GetTestData("crypto/x509/test/policy_root.pem").c_str()));
   ASSERT_TRUE(root);
+  bssl::UniquePtr<X509> root_cross_inhibit_mapping(CertFromPEM(
+      GetTestData("crypto/x509/test/policy_root_cross_inhibit_mapping.pem")
+          .c_str()));
+  ASSERT_TRUE(root_cross_inhibit_mapping);
+  bssl::UniquePtr<X509> root2(
+      CertFromPEM(GetTestData("crypto/x509/test/policy_root2.pem").c_str()));
+  ASSERT_TRUE(root2);
   bssl::UniquePtr<X509> intermediate(CertFromPEM(
       GetTestData("crypto/x509/test/policy_intermediate.pem").c_str()));
   ASSERT_TRUE(intermediate);
@@ -5516,6 +5523,25 @@
              [&](X509_VERIFY_PARAM *param) {
                set_policies(param, {oid4.get()});
              }));
+
+  // Policy mapping can be inhibited, either by the caller or a certificate in
+  // the chain, in which case mapped policies are unassertable (apart from some
+  // anyPolicy edge cases).
+  EXPECT_EQ(
+      X509_V_ERR_NO_EXPLICIT_POLICY,
+      Verify(leaf_oid1.get(), {root.get()}, {intermediate_mapped_oid3.get()},
+             /*crls=*/{}, X509_V_FLAG_EXPLICIT_POLICY | X509_V_FLAG_INHIBIT_MAP,
+             [&](X509_VERIFY_PARAM *param) {
+               set_policies(param, {oid3.get()});
+             }));
+  EXPECT_EQ(
+      X509_V_ERR_NO_EXPLICIT_POLICY,
+      Verify(leaf_oid1.get(), {root2.get()},
+             {intermediate_mapped_oid3.get(), root_cross_inhibit_mapping.get()},
+             /*crls=*/{}, X509_V_FLAG_EXPLICIT_POLICY,
+             [&](X509_VERIFY_PARAM *param) {
+               set_policies(param, {oid3.get()});
+             }));
 }
 
 #if defined(OPENSSL_THREADS)
diff --git a/sources.cmake b/sources.cmake
index 881cb15..021e920 100644
--- a/sources.cmake
+++ b/sources.cmake
@@ -134,7 +134,9 @@
   crypto/x509/test/policy_leaf_require.pem
   crypto/x509/test/policy_leaf_require1.pem
   crypto/x509/test/policy_leaf.pem
+  crypto/x509/test/policy_root_cross_inhibit_mapping.pem
   crypto/x509/test/policy_root.pem
+  crypto/x509/test/policy_root2.pem
   crypto/x509/test/pss_sha1_explicit.pem
   crypto/x509/test/pss_sha1_mgf1_syntax_error.pem
   crypto/x509/test/pss_sha1.pem