Seen in several production clusters running 8.3 (thanks to the changes in #87881) but this also explains #86059 in earlier versions:

    [instance-0000000011] negative value in circuit breaker: [eql_sequence,limit=8589934592/8gb,estimated=-7961288

My guess is that somehow this circuit breaker is releasing bytes it didn't already hold. Seems pretty rare, and not covered by tests since it would trip assertions there.
x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/execution/sequence/SequenceMatcher.java
private final KeyToSequences keyToSequences;
    
    private final StageToKeys stageToKeys;
    private final int numberOfStages;
    private final int completionStage;
    
    
    private final Set<Sequence> completed;
    private final long maxSpanInNanos;
    private final boolean descending;
    private final Limit limit;
    private final CircuitBreaker circuitBreaker;
    private final Stats stats = new Stats();
    private boolean headLimit = false;
    private long totalRamBytesUsed = 0;
    @SuppressWarnings("rawtypes")
    public SequenceMatcher(int stages, boolean descending, TimeValue maxSpan, Limit limit, CircuitBreaker circuitBreaker) {
        this.numberOfStages = stages;
        this.completionStage = stages - 1;
        this.descending = descending;
        this.stageToKeys = new StageToKeys(completionStage);
        this.keyToSequences = new KeyToSequences(completionStage);
        this.completed = new TreeSet<>();
        this.maxSpanInNanos = maxSpan.nanos();
        this.limit = limit;
        this.circuitBreaker = circuitBreaker;
    }
    private void trackSequence(Sequence sequence) {
        SequenceKey key = sequence.key();
        stageToKeys.add(0, key);