diff --git a/crates/xfa/src/layout/draw.rs b/crates/xfa/src/layout/draw.rs
index 9c0b385c63..ace5bb93ac 100644
--- a/crates/xfa/src/layout/draw.rs
+++ b/crates/xfa/src/layout/draw.rs
@@ -242,14 +242,29 @@ impl Layouter<'_> {
         // Text that doesn't fit the height it was given (the template's face is narrower than
         // the standard one drawn in its place, so it wraps to more lines) is drawn smaller,
         // down to 70%, rather than over what lies below.
-        let fits = |k: f64| {
+        // A pass is not started once the budget is spent, and one that spends it stops the rest.
+        let fits = |k: f64| -> Result<bool, XfaError> {
+            self.check_drawn_chars()?;
             self.drawn_chars.set(self.drawn_chars.get().saturating_add(cost));
-            text::measure_height(&rich, rect.w / k, para, &face, &embed) <= rect.h / k + 1.0
+            let fit = text::measure_height(&rich, rect.w / k, para, &face, &embed) <= rect.h / k + 1.0;
+            self.check_drawn_chars()?;
+            Ok(fit)
         };
-        let scale = if rect.h < 4.0 || fits(1.0) { 1.0 } else { [0.95, 0.9, 0.85, 0.8, 0.75].into_iter().find(|k| fits(*k)).unwrap_or(0.7) };
+        let mut scale = 1.0;
+        if rect.h >= 4.0 && !fits(1.0)? {
+            scale = 0.7;
+            for k in [0.95, 0.9, 0.85, 0.8, 0.75] {
+                if fits(k)? {
+                    scale = k;
+                    break;
+                }
+            }
+        }
         self.drawn_chars.set(self.drawn_chars.get().saturating_add(cost));
         self.check_drawn_chars()?;
         let mut block = text::layout(&rich, Rect::new(rect.x, rect.y, rect.w / scale, rect.h / scale), para, &face, &embed);
+        // The layout itself expands the embedded values once more.
+        self.check_drawn_chars()?;
         if scale < 1.0 {
             for s in &mut block.spans {
                 s.x = rect.x + (s.x - rect.x) * scale;
diff --git a/crates/xfa/src/tests.rs b/crates/xfa/src/tests.rs
index 29e5e0da0a..d1edc8f6d0 100644
--- a/crates/xfa/src/tests.rs
+++ b/crates/xfa/src/tests.rs
@@ -713,6 +713,40 @@ fn embedded_values_drawn_in_many_instances_spend_the_draw_budget() {
     assert!(layout_xml(&one).is_ok(), "a single draw embedding a long value must lay out");
 }
 
+/// The last layout pass of a draw counts against the budget too: a draw that fits is measured
+/// once and laid out once, each pass expanding its embedded value, and when the form's last draw
+/// crosses the budget in that final pass it is still refused (CodeRabbit review on #5852).
+#[test]
+fn the_draw_that_crosses_the_budget_in_its_last_pass_is_refused() {
+    // 15,000 characters: with the 1 MiB test budget, the tenth such draw crosses it during its
+    // final layout pass, after every check before that pass has passed.
+    let value = "word ".repeat(3000);
+    let span = r##"<span xfa:embed="#long" xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/"/>"##;
+    let form = |n: usize| {
+        format!(
+            r#"<template><subform layout="tb"><field id="long" presence="hidden" w="1in" h="0.2in"><ui><textEdit/></ui><value><text>{value}</text></value></field><subform layout="tb"><occur initial="{n}" max="-1"/><draw w="7in" h="9in"><value><exData contentType="text/html"><body xmlns="http://www.w3.org/1999/xhtml"><p>x {span}</p></body></exData></value></draw></subform></subform></template>"#
+        )
+    };
+    assert!(layout_xml(&form(9)).is_ok());
+    assert!(matches!(layout_xml(&form(10)), Err(XfaError::TooLarge(_))), "the draw crossing the budget in its last pass must be refused");
+}
+
+/// Once a fit pass spends the budget, no more passes are made: a draw that doesn't fit and embeds
+/// a long value is measured once, not seven times, before it is refused (CodeRabbit review on
+/// #5852).
+#[test]
+fn fit_passes_stop_once_the_draw_budget_is_spent() {
+    let value = "word ".repeat(text::MAX_EMBEDDED / 5 + 1000);
+    let span = r##"<span xfa:embed="#long" xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/"/>"##;
+    let tpl = format!(
+        r#"<template><subform layout="tb"><field id="long" presence="hidden" w="1in" h="0.2in"><ui><textEdit/></ui><value><text>{value}</text></value></field><draw w="1in" h="0.5in"><value><exData contentType="text/html"><body xmlns="http://www.w3.org/1999/xhtml"><p>x {span}</p></body></exData></value></draw></subform></template>"#
+    );
+    crate::layout::EMBED_COPIED.with(|c| c.set(0));
+    assert!(matches!(layout_xml(&tpl), Err(XfaError::TooLarge(_))));
+    let copied = crate::layout::EMBED_COPIED.with(|c| c.get());
+    assert!(copied <= 2 * text::MAX_EMBEDDED as u64, "{copied} bytes copied: more passes after the budget was spent");
+}
+
 #[test]
 fn a_packet_stream_listed_many_times_is_read_once() {
     let mut doc = Document::open(Arc::new(shell("<template><subform/></template>"))).unwrap();