Seen in several production clusters running 8.3 (thanks to the changes in #87881) but this also explains #86059 in earlier versions:

    [instance-0000000011] negative value in circuit breaker: [eql_sequence,limit=8589934592/8gb,estimated=-7961288

My guess is that somehow this circuit breaker is releasing bytes it didn't already hold. Seems pretty rare, and not covered by tests since it would trip assertions there.
x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/execution/sequence/CircuitBreakerTests.java
} else if (request instanceof ClosePointInTimeRequest) {
                ClosePointInTimeResponse response = new ClosePointInTimeResponse(true, 1);
                assert pitContextCounter.get() > 0;
                pitContextCounter.decrementAndGet();
                listener.onResponse((Response) response);
            } else if (request instanceof SearchRequest searchRequest) {
                searchRequestsRemainingCount--;
                assertTrue(searchRequestsRemainingCount >= 0);
                assertEquals(0, circuitBreaker.getTrippedCount());
                handleSearchRequest(listener, searchRequest);
                assert pitContextCounter.get() == 0;
            } else {
                super.doExecute(action, request, listener);
            }
        }
        int searchRequestsRemainingCount() {
            return searchRequestsRemainingCount;
        }
    }
    /*
     * For a successful sequence request, there will be two search requests expected
     */
    private class SuccessfulESMockClient extends ESMockClient {
        SuccessfulESMockClient(CircuitBreaker circuitBreaker, int expectedSearchRequestsCount) {
            super(circuitBreaker, expectedSearchRequestsCount);
        }
        @SuppressWarnings("unchecked")
        @Override
        <Response extends ActionResponse> void handleSearchRequest(ActionListener<Response> listener, SearchRequest searchRequest) {
            int ordinal = searchRequest.source().terminateAfter();