diff --git a/sys/kern/sys_pipe.c b/sys/kern/sys_pipe.c
--- a/sys/kern/sys_pipe.c
+++ b/sys/kern/sys_pipe.c
@@ -431,6 +431,11 @@
 		lwkt_token_init(&pipe->bufferB.wlock, "pipew");
 	}
 	*pipep = pipe;
+	pipe->open_count = 2;			/* DF-0031: set before pipespace() so the
+					   error-path pipeclose() cleanup in kern_pipe
+					   decrements cleanly to 0.  Was set only after
+					   both pipespace()s succeeded, leaving 0 on a
+					   partial failure -> open_count underflow + leak. */
 	if ((error = pipespace(pipe, &pipe->bufferA, pipe_size)) != 0) {
 		return (error);
 	}
@@ -442,7 +447,6 @@
 	pipe->bufferA.mtime = pipe->ctime;
 	pipe->bufferB.atime = pipe->ctime;
 	pipe->bufferB.mtime = pipe->ctime;
-	pipe->open_count = 2;
 
 	return (0);
 }