4 files changed, 17 insertions, 6 deletions

diff --git a/src/core/hle/service/nvdrv/core/nvmap.cpp b/src/core/hle/service/nvdrv/core/nvmap.cpp
index fbd8a74a5..a51ca5444 100644
--- a/src/core/hle/service/nvdrv/core/nvmap.cpp
+++ b/src/core/hle/service/nvdrv/core/nvmap.cpp
@@ -255,15 +255,16 @@ std::optional<NvMap::FreeInfo> NvMap::FreeHandle(Handle::Id handle, bool interna
             .address = handle_description->address,
             .size = handle_description->size,
             .was_uncached = handle_description->flags.map_uncached.Value() != 0,
+            .can_unlock = true,
         };
     } else {
         return std::nullopt;
     }
 
-    // Handle hasn't been freed from memory, set address to 0 to mark that the handle wasn't freed
+    // If the handle hasn't been freed from memory, mark that
     if (!hWeak.expired()) {
         LOG_DEBUG(Service_NVDRV, "nvmap handle: {} wasn't freed as it is still in use", handle);
-        freeInfo.address = 0;
+        freeInfo.can_unlock = false;
     }
 
     return freeInfo;
diff --git a/src/core/hle/service/nvdrv/core/nvmap.h b/src/core/hle/service/nvdrv/core/nvmap.h
index b9dd3801f..a8e573890 100644
--- a/src/core/hle/service/nvdrv/core/nvmap.h
+++ b/src/core/hle/service/nvdrv/core/nvmap.h
@@ -105,6 +105,7 @@ public:
         u64 address;       //!< Address the handle referred to before deletion
         u64 size;          //!< Page-aligned handle size
         bool was_uncached; //!< If the handle was allocated as uncached
+        bool can_unlock;   //!< If the address region is ready to be unlocked
     };
 
     explicit NvMap(Tegra::Host1x::Host1x& host1x);
diff --git a/src/core/hle/service/nvdrv/devices/nvmap.cpp b/src/core/hle/service/nvdrv/devices/nvmap.cpp
index b60679021..44388655d 100644
--- a/src/core/hle/service/nvdrv/devices/nvmap.cpp
+++ b/src/core/hle/service/nvdrv/devices/nvmap.cpp
@@ -251,10 +251,12 @@ NvResult nvmap::IocFree(const std::vector<u8>& input, std::vector<u8>& output) {
     }
 
     if (auto freeInfo{file.FreeHandle(params.handle, false)}) {
-        ASSERT(system.CurrentProcess()
-                   ->PageTable()
-                   .UnlockForDeviceAddressSpace(freeInfo->address, freeInfo->size)
-                   .IsSuccess());
+        if (freeInfo->can_unlock) {
+            ASSERT(system.CurrentProcess()
+                       ->PageTable()
+                       .UnlockForDeviceAddressSpace(freeInfo->address, freeInfo->size)
+                       .IsSuccess());
+        }
         params.address = freeInfo->address;
         params.size = static_cast<u32>(freeInfo->size);
         params.flags.raw = 0;
diff --git a/src/core/hle/service/nvflinger/buffer_queue_producer.cpp b/src/core/hle/service/nvflinger/buffer_queue_producer.cpp
index 77ddbb6ef..41ba44b21 100644
--- a/src/core/hle/service/nvflinger/buffer_queue_producer.cpp
+++ b/src/core/hle/service/nvflinger/buffer_queue_producer.cpp
@@ -742,6 +742,13 @@ Status BufferQueueProducer::Disconnect(NativeWindowApi api) {
             return Status::NoError;
         }
 
+        // HACK: We are not Android. Remove handle for items in queue, and clear queue.
+        // Allows synchronous destruction of nvmap handles.
+        for (auto& item : core->queue) {
+            nvmap.FreeHandle(item.graphic_buffer->BufferId(), true);
+        }
+        core->queue.clear();
+
         switch (api) {
         case NativeWindowApi::Egl:
         case NativeWindowApi::Cpu: