diff --git a/sys/dev/drm/i915/i915_request.c b/sys/dev/drm/i915/i915_request.c
--- a/sys/dev/drm/i915/i915_request.c
+++ b/sys/dev/drm/i915/i915_request.c
@@ -782,13 +782,25 @@
 
 	i915_sched_node_init(&rq->sched);
 
-	/* No zalloc, must clear what we need by hand */
+	/*
+	 * No zalloc, must clear what we need by hand.
+	 * DF-1527: postfix (and head/infix/tail) are consumed by
+	 * i915_request_skip() and ring-reset paths even before
+	 * i915_request_add() assigns them; the request slab is
+	 * SLAB_TYPESAFE_BY_RCU and is NOT zeroed on realloc, so a stale
+	 * postfix from a previous request can drive a bogus memset().
+	 * Initialise them explicitly here.
+	 */
 	rq->global_seqno = 0;
 	rq->signaling.wait.seqno = 0;
 	rq->file_priv = NULL;
 	rq->batch = NULL;
 	rq->capture_list = NULL;
 	rq->waitboost = false;
+	rq->head = 0;
+	rq->infix = 0;
+	rq->postfix = 0;
+	rq->tail = 0;
 
 	/*
 	 * Reserve space in the ring buffer for all the commands required to