diff --git a/sys/dev/drm/linux_dma-buf.c b/sys/dev/drm/linux_dma-buf.c
index 0748246..6e27176 100644
--- a/sys/dev/drm/linux_dma-buf.c
+++ b/sys/dev/drm/linux_dma-buf.c
@@ -181,8 +181,15 @@ dma_buf_get(int fd)
 	}
 
 	dmabuf = fp->private_data;
-	dropfp(curthread, fd, fp);
 
+	/*
+	 * Linux contract: return the dma_buf with the file reference held
+	 * (fget); the caller drops it with dma_buf_put().  Dropping the
+	 * reference here lets a racing close() free the dma_buf while the
+	 * caller still uses it, and makes drm_gem_prime_fd_to_handle()'s
+	 * trailing dma_buf_put() an unbalanced fdrop (refcount underflow,
+	 * premature free, use-after-free).
+	 */
 	return dmabuf;
 }