> [25322.031213] 	0x0000000b

This value is written to the R_028A3C_VGT_GROUP_VECT_1_FMT_CNTL register.
However, the driver only ever writes 0 to that register, in si_init_config().

> [25322.031214] 	0x00000000 <---
> [25322.031215] 	0x00000295
> [25322.031215] 	0x00000080
> [25322.031216] 	0x00000040
> [25322.031217] 	0x00000002

The values after the arrow look like the following series of register writes to
R_028A54_VGT_GS_PER_ES and the two following registers.

So, it looks like the value for the R_028A3C_VGT_GROUP_VECT_1_FMT_CNTL register
and the following PKT3_SET_CONTEXT_REG header were scribbled over with the
value 0x0000000b00000000. Looks like memory corruption to me.

Running firefox in valgrind or with something like the GCC / clang address
sanitizers might give a clue, but might be painful.