Actually I have to admit... while I had a plausible explanation for the first instance, I do not for the second. Context deletion correctly cleans this stuff up, nv30_state_validate should check if a new context is being used and set up the new pointers. The way nv30 handles bufctx stuff is different than nv50+, and I don't think it's with good reason. I may try rewriting it.