diff --git a/.pick_status.json b/.pick_status.json
index 848b82bd205..375d78f1752 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -4,7 +4,7 @@
         "description": "vc4: fix unwanted buffer release on uploader",
         "nominated": true,
         "nomination_type": 2,
-        "resolution": 0,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": "b3133e250e1c40496d98c4ba52386b7ae423d194",
         "notes": null
diff --git a/src/broadcom/ci/broadcom-rpi3-fails.txt b/src/broadcom/ci/broadcom-rpi3-fails.txt
index b2439ad42d1..0f97e6722f2 100644
--- a/src/broadcom/ci/broadcom-rpi3-fails.txt
+++ b/src/broadcom/ci/broadcom-rpi3-fails.txt
@@ -765,9 +765,6 @@ spec@glsl-1.10@execution@glsl-vs-inline-explosion,Crash
 # stipple
 spec@!opengl 1.0@gl-1.0-no-op-paths,Fail
 
-# Bisected to b3133e250e1 ("gallium: add pipe_context::resource_release to eliminate buffer refcounting")
-spec@!opengl 1.1@longprim,Crash
-
 # fails on arm64, passes on armhf
 spec@arb_depth_buffer_float@depthstencil-render-miplevels 1024 s=z24_s8_d=z32f,Fail
 
diff --git a/src/gallium/drivers/vc4/vc4_resource.c b/src/gallium/drivers/vc4/vc4_resource.c
index 1e2d9c50701..cb4a908d822 100644
--- a/src/gallium/drivers/vc4/vc4_resource.c
+++ b/src/gallium/drivers/vc4/vc4_resource.c
@@ -1148,12 +1148,6 @@ vc4_get_shadow_index_buffer(struct pipe_context *pctx,
         struct vc4_resource *orig = vc4_resource(info->index.resource);
         perf_debug("Fallback conversion for %d uint indices\n", count);
 
-        void *data;
-        struct pipe_resource *shadow_rsc = NULL;
-        u_upload_alloc_ref(vc4->uploader, 0, count * 2, 4,
-                       shadow_offset, &shadow_rsc, &data);
-        uint16_t *dst = data;
-
         struct pipe_transfer *src_transfer = NULL;
         const uint32_t *src;
         if (info->has_user_indices) {
@@ -1165,6 +1159,20 @@ vc4_get_shadow_index_buffer(struct pipe_context *pctx,
                                             PIPE_MAP_READ, &src_transfer);
         }
 
+        /* We need to do the upload alloc ref after the
+         * pipe_buffer_map_range() because there is a risk that the alloc
+         * frees and destroy its internal buffer, which might be the original
+         * base buffer we want to copy. Calling it afterwards, we guarantee
+         * that pipe_buffer_map_range() increases the reference counter so if
+         * upload alloc ref needs to unreference it, the buffer doesn't reach
+         * 0 refcounts and thus it won't be destroyed.
+         */
+        void *data;
+        struct pipe_resource *shadow_rsc = NULL;
+        u_upload_alloc_ref(vc4->uploader, 0, count * 2, 4,
+                       shadow_offset, &shadow_rsc, &data);
+        uint16_t *dst = data;
+
         for (int i = 0; i < count; i++) {
                 uint32_t src_index = src[i];
                 assert(src_index <= 0xffff);