In red_wait_pipe_item_sent red_worker increased and decreased the reference to the pipe item using channel_cbs->hold_item, and channel_cbs->release_item.
These calls can be called only by red_channel
display_channel_client_release_item_before_push is called twice and leads to a double call to ring_remove(&dpi->base).
Instead ref/put_drawable_pipe_item are called.
For each item ring_remove is called once, as it should. spice-server does not abort.