I found some really nice stainless steel coat hooks that have spring-loaded levers that close off the hook opening, like carabiners. So I got 8 of these hooks and made two oak rails to mount them to, along with some brackets to mount the rails above the windows on each side of the vehicle. Each oak rail goes approximately from the B-pillar to 8" forward of the rear hatch. These 8 hooks will support a net to store light things up against the headliner.

Each bracket consists of a bent part that bolts to the 4Runner body, and a square part that bolts to the oak rail.

Pictures below: from the open rear hatch; front part of the driver's side rail; rear part of the driver's side rail; close-up of the front bracket; close-up of the rear bracket. To get the rail level, the bent part of the rear bracket is longer than the bent part of the front bracket.

Some specs and construction details:

Each oak rail is 3/4" x 1 1/2" x 60", and there are 4 hooks per rail, spaced 19" apart. The rails are about 37" apart at the rear and 40" apart at the front.

In each bracket, the bent part is 1/8" thick mild steel, and the square part is cut from 1 1/4" x 1 1/4" square steel tubing pre-punched with holes. Steel bar and punched steel tubing are from Home Depot.

All purchased bolts were Phillips drive, panhead M8 x 1.25 stainless steel, with matching nylon insert lock nuts. 35mm bolts were used to attach the oak rails to the square parts of the brackets. 20mm bolts were used to attach the square part to the bent part of each bracket.

In the rear brackets, OEM bolts were used to attach the bent part of the bracket to the OEM welded nut in the 4Runner body. In the front brackets, 20mm bolts were used to attach the bent part to the M8 x 1.25 nut installed here:
Threaded nut above 2nd row windows

The 1 1/4" x 1 1/4" square steel tubing is of ideal dimension. It holds the oak rail far enough away from the curved headliner that a 5' run of oak rail will fit, except that I had to shave off some of the front corner (near the B-pillar) with a plane and rasp. (If the oak rails are attached directly to the bent part of the brackets, omitting the square parts entirely, then the rail has to be shortened to maybe 4' or less to fit, due to the curvature of the headliner.) The pre-punched holes in the square tubing are big enough for the M8 bolts and also for the screwdriver needed to drive them. The opening of the square tubing is just big enough for a wrench to hold an M8 nut inside the square part when bolting the oak rail to it. The opening is also big enough to allow a Phillips screwdriver to go in from below to secure the front bracket to the 4Runner body.

Attached Images

         

... what is this going to be used for?

"These 8 hooks will support a net to store light things up against the headliner"

Some ideas for what to store up against the headliner:
- Clothing.
- Window covers. For privacy when sleeping inside the vehicle, I made window covers out of 1" Thinsulate, with 1/4" Owens Corning Foamular for rigidity so that the window covers stay put when pushed up against the window glass. I sewed a ripstop nylon cover around these two layers.
- Flexible solar panels, to be deployed once in camp. These are about 0.1" thick and weigh only a few pounds. To hold them more securely, I would probably make some kind of framework attached to the oak rails.

Besides holding a cargo net in place, the hooks can be used to hang things. Also, the oak rails provide a place up high inside the vehicle to attach other things that might prove useful in the future.

Where are the side curtain airbags?

I believe the side curtain airbags are hidden behind the sheet metal that is behind the headliner, just above the top edges of the windows on each side of the vehicle. My understanding is that during a rollover, these airbags deploy through the crack where the bottom edge of the headliner meets the rest of the interior of the vehicle.

The 2nd photo in Post #1 above shows two small rectangular holes in the headliner. There are actually three holes in that general area - the third one is on the right, behind the small steel bracket that I made. Of these three holes, the one on the left and the one on the right are where Toyota mounted the 2nd row grab handle.

After I cut the middle hole in the headliner, I felt around inside with my pinkie finger and felt what seems like a fabric bag filled with something. I believe this is the side curtain airbag.

Since the M8 nut that I installed behind the front bracket is JBWelded to the front of the sheet metal (between the sheet metal and the headliner), I think it will not interfere with airbag deployment.

The bottom surfaces of the oak rails are about level with the top edges of the windows, and held a little away from the headliner, so I think they would also not interfere with airbag deployment. But that is just my best guess. It would be helpful to see a slow motion video of the side airbags deploying.

You mean like the following?

Products
– Toyota Nets

Cargo, barrier and dog safety nets - Raingler Nets

Yes, thanks for the links. I especially like this full-length cargo net:

Full Length Ceiling Net for Toyota 4Runner 2010 and newer (5th Gen)
– Toyota Nets

But I will probably make my own from some combination of paracord, webbing, and mesh.

I also thought about adding a couple attachment points at the very rear edge of the headliner, just above the top edge of the rear window, since my oak rails end 8" from that edge. These adhesive-mount studs are a cleaner version of the nut with stainless backing plate that I JBWelded above the 2nd row window:

McMaster-Carr