--- a/sys/dev/drm/i915/i915_gem_execbuffer.c	2026-09-17 12:25:57.950232189 +0000
+++ b/sys/dev/drm/i915/i915_gem_execbuffer.c	2026-09-17 12:31:21.582088393 +0000
@@ -1867,11 +1867,20 @@
 			return err;
 		}
 
-		__eb_unreserve_vma(vma, flags);
+		/*
+		 * Clear the reserved flags so that a later eb_release_vmas()
+		 * (error unwinding after an i915_vma_move_to_active() failure
+		 * below) cannot double-unreserve this vma: pin/fence pins and
+		 * the __EXEC_OBJECT_HAS_REF reference would otherwise be
+		 * dropped twice, underflowing refcounts.
+		 */
+		eb_unreserve_vma(vma, &eb->flags[i]);
 		vma->exec_flags = NULL;
 
-		if (unlikely(flags & __EXEC_OBJECT_HAS_REF))
+		if (unlikely(flags & __EXEC_OBJECT_HAS_REF)) {
 			i915_vma_put(vma);
+			eb->flags[i] &= ~__EXEC_OBJECT_HAS_REF;
+		}
 	}
 	eb->exec = NULL;