Seen in several production clusters running 8.3 (thanks to the changes in #87881) but this also explains #86059 in earlier versions:

    [instance-0000000011] negative value in circuit breaker: [eql_sequence,limit=8589934592/8gb,estimated=-7961288

My guess is that somehow this circuit breaker is releasing bytes it didn't already hold. Seems pretty rare, and not covered by tests since it would trip assertions there.
x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/execution/sequence/CircuitBreakerTests.java
searchRequest.pointInTimeBuilder().getEncodedId()
                );
                listener.onResponse((Response) response);
            } else {
                assertTrue(circuitBreaker.getUsed() > 0); 
                ShardSearchFailure[] failures = new ShardSearchFailure[] {
                    new ShardSearchFailure(
                        new ParsingException(1, 2, "foobar", null),
                        new SearchShardTarget("node_1", new ShardId("foo", "_na_", 1), null)
                    ) };
                if (randomBoolean()) {
                    
                    listener.onFailure(new SearchPhaseExecutionException("search", "all shards failed", failures));
                } else {
                    
                    SearchResponse response = new SearchResponse(
                        new InternalSearchResponse(
                            new SearchHits(new SearchHit[] { new SearchHit(1) }, new TotalHits(1L, TotalHits.Relation.EQUAL_TO), 1.0f),
                            null,
                            new Suggest(Collections.emptyList()),
                            new SearchProfileResults(Collections.emptyMap()),
                            false,
                            false,
                            1
                        ),
                        null,
                        2,
                        1,
                        0,
                        0,