diff --git a/win32ss/gdi/ntgdi/bitblt.c b/win32ss/gdi/ntgdi/bitblt.c
index 1fca961e471..17172732a8c 100644
--- a/win32ss/gdi/ntgdi/bitblt.c
+++ b/win32ss/gdi/ntgdi/bitblt.c
@@ -385,6 +385,7 @@ NtGdiMaskBlt(
     if (!GDIOBJ_bLockMultipleObjects(2, (HGDIOBJ*)ahDC, apObj, GDIObjType_DC_TYPE))
     {
         WARN("Invalid dc handle (dest=0x%p, src=0x%p) passed to NtGdiMaskBlt\n", hdcDest, hdcSrc);
+        if(psurfMask) SURFACE_ShareUnlockSurface(psurfMask);
         EngSetLastError(ERROR_INVALID_HANDLE);
         return FALSE;
     }
@@ -396,6 +397,7 @@ NtGdiMaskBlt(
     {
         if(DCSrc) DC_UnlockDc(DCSrc);
         WARN("Invalid destination dc handle (0x%p) passed to NtGdiMaskBlt\n", hdcDest);
+        if(psurfMask) SURFACE_ShareUnlockSurface(psurfMask);
         return FALSE;
     }
 
@@ -404,6 +406,7 @@ NtGdiMaskBlt(
         if(DCSrc) DC_UnlockDc(DCSrc);
         DC_UnlockDc(DCDest);
         /* Yes, Windows really returns TRUE in this case */
+        if(psurfMask) SURFACE_ShareUnlockSurface(psurfMask);
         return TRUE;
     }
 
@@ -415,6 +418,7 @@ NtGdiMaskBlt(
             DC_UnlockDc(DCDest);
             DC_UnlockDc(DCSrc);
             /* Yes, Windows really returns TRUE in this case */
+            if(psurfMask) SURFACE_ShareUnlockSurface(psurfMask);
             return TRUE;
         }
     }