diff --git a/src/freedreno/.gitlab-ci/reference/crash.log b/src/freedreno/.gitlab-ci/reference/crash.log
index 492f398f73a..2b1a08e9d4e 100644
--- a/src/freedreno/.gitlab-ci/reference/crash.log
+++ b/src/freedreno/.gitlab-ci/reference/crash.log
@@ -1670,7 +1670,7 @@ registers:
 	00000000	0xb622: 00000000
 	00000000	0xb623: 00000000
 got rb_base=1000000001000
-IB1: 100000000, 6
+IB1: 100000000, 5
 IB2: 0, 0
 found ring!
 got cmdszdw=27
diff --git a/src/freedreno/decode/crashdec.c b/src/freedreno/decode/crashdec.c
index b1df32d69ff..df8558783b2 100644
--- a/src/freedreno/decode/crashdec.c
+++ b/src/freedreno/decode/crashdec.c
@@ -359,8 +359,10 @@ dump_cmdstream(void)
     * by name rather than hard-coding this.
     */
    if (is_a6xx()) {
-      options.ibs[1].rem += regval("CP_ROQ_AVAIL_IB1") >> 16;
-      options.ibs[2].rem += regval("CP_ROQ_AVAIL_IB2") >> 16;
+      uint32_t ib1_rem = regval("CP_ROQ_AVAIL_IB1") >> 16;
+      uint32_t ib2_rem = regval("CP_ROQ_AVAIL_IB2") >> 16;
+      options.ibs[1].rem += ib1_rem ? ib1_rem - 1 : 0;
+      options.ibs[2].rem += ib2_rem ? ib2_rem - 1 : 0;
    }
 
    printf("IB1: %" PRIx64 ", %u\n", options.ibs[1].base, options.ibs[1].rem);