fun observation: Instead of reverting, setting this at the end of r600_cp_dma_copy_buffer() appears to fix it for me: rctx->b.flags |= R600_CONTEXT_INV_VERTEX_CACHE; (R600_CONTEXT_INV_CONST_CACHE will also work) Thing I don't understand about this is that if I instead set the flag just before r600_flush_emit() is called (2 places) the corruption is still there. I must be missing something.