Comment # 3 on bug 102349 from Ilia Mirkin

F*&#$%. Of course. In the nv30_clear path. Can you throw

   push->user_priv = &nv30->bufctx;

Somewhere towards the top of nv30_clear (before it calls nv30_state_validate)