The multi-crtc cursor code in hw/xfree86/modes holds a reference to the current cursor. This reference must be correctly ref counted so the cursor is not freed out from underneath this code.