--- a/sys/dev/drm/linux_dma-buf.c
+++ b/sys/dev/drm/linux_dma-buf.c
@@ -181,6 +181,10 @@
 	}
 
 	dmabuf = fp->private_data;
+	/* Hold a real reference for the caller: dma_buf_put() does an
+	 * unconditional fdrop(dmabuf->file), so dma_buf_get() must return
+	 * the dmabuf owning one reference (mirrors Linux fget semantics). */
+	fhold(fp);
 	dropfp(curthread, fd, fp);
 
 	return dmabuf;