Setting the environment variable R600_DEBUG=noinvalrange should fix this. I'm still trying to figure out what's wrong with it. It looks like a synchronization issue, because doing a context flush in r600_buffer_transfer_unmap fixes it.