Index: sys/compat/cloudabi/cloudabi_fd.c
===================================================================
--- sys/compat/cloudabi/cloudabi_fd.c
+++ sys/compat/cloudabi/cloudabi_fd.c
@@ -95,7 +95,7 @@
 		cap_rights_init(&fcaps.fc_rights, CAP_FSTAT, CAP_FTRUNCATE,
 		    CAP_MMAP_RWX);
 		return (kern_shm_open(td, SHM_ANON, O_RDWR | O_CLOEXEC, 0,
-		    &fcaps));
+		    &fcaps, NULL));
 	default:
 		return (EINVAL);
 	}
Index: sys/kern/uipc_shm.c
===================================================================
--- sys/kern/uipc_shm.c
+++ sys/kern/uipc_shm.c
@@ -697,7 +697,7 @@
 
 int
 kern_shm_open(struct thread *td, const char *userpath, int flags, mode_t mode,
-    struct filecaps *fcaps)
+    struct filecaps *fcaps, struct file **fpp)
 {
 	struct filedesc *fdp;
 	struct shmfd *shmfd;
@@ -841,7 +841,14 @@
 	finit(fp, FFLAGS(flags & O_ACCMODE), DTYPE_SHM, shmfd, &shm_ops);
 
 	td->td_retval[0] = fd;
-	fdrop(fp, td);
+	/*
+	 * The caller is responsible for dropping the reference if they take
+	 * the file pointer from kern_shm_open().
+	 */
+	if (fpp != NULL)
+		*fpp = fp;
+	else
+		fdrop(fp, td);
 
 	return (0);
 }
@@ -852,7 +859,7 @@
 {
 
 	return (kern_shm_open(td, uap->path, uap->flags | O_CLOEXEC, uap->mode,
-	    NULL));
+	    NULL, NULL));
 }
 
 int
Index: sys/sys/syscallsubr.h
===================================================================
--- sys/sys/syscallsubr.h
+++ sys/sys/syscallsubr.h
@@ -250,7 +250,7 @@
 int	kern_settimeofday(struct thread *td, struct timeval *tv,
 	    struct timezone *tzp);
 int	kern_shm_open(struct thread *td, const char *userpath, int flags,
-	    mode_t mode, struct filecaps *fcaps);
+	    mode_t mode, struct filecaps *fcaps, struct file **fpp);
 int	kern_shmat(struct thread *td, int shmid, const void *shmaddr,
 	    int shmflg);
 int	kern_shmctl(struct thread *td, int shmid, int cmd, void *buf,