Seen in several production clusters running 8.3 (thanks to the changes in #87881) but this also explains #86059 in earlier versions:

    [instance-0000000011] negative value in circuit breaker: [eql_sequence,limit=8589934592/8gb,estimated=-7961288

My guess is that somehow this circuit breaker is releasing bytes it didn't already hold. Seems pretty rare, and not covered by tests since it would trip assertions there.
x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/execution/sequence/CircuitBreakerTests.java
}
        @Override
        public void fetchHits(Iterable<List<HitReference>> refs, ActionListener<List<List<SearchHit>>> listener) {
            List<List<SearchHit>> searchHits = new ArrayList<>();
            for (List<HitReference> ref : refs) {
                List<SearchHit> hits = new ArrayList<>(ref.size());
                for (HitReference hitRef : ref) {
                    hits.add(new SearchHit(-1, hitRef.id(), null, null));
                }
                searchHits.add(hits);
            }
            listener.onResponse(searchHits);
        }
    }
    public void testCircuitBreakerTumblingWindow() {
        QueryClient client = new TestQueryClient();
        List<Criterion<BoxedQueryRequest>> criteria = new ArrayList<>(stages);
        for (int i = 0; i < stages; i++) {
            final int j = i;
            criteria.add(
                new Criterion<>(
                    i,
                    new BoxedQueryRequest(
                        () -> SearchSourceBuilder.searchSource().size(10).query(matchAllQuery()).terminateAfter(j),
                        "@timestamp",
                        emptyList(),
                        emptySet()
                    ),
                    keyExtractors,
                    tsExtractor,