I don't know why using uint64_t for "base" doesn't work. Ugh.

src/mesa/pipe/cell/common.h

@@ -124,11 +124,12 @@ struct cell_command_clear_surface
  */
 struct cell_array_info
 {
-    uint64_t base;      /**< Base address of the 0th element. */
+    uint opcode;
+    uint base;          /**< Base address of the 0th element. */
     uint attr;          /**< Attribute that this state if for. */
     uint pitch;         /**< Byte pitch from one entry to the next. */
     uint format;        /**< Pipe format of each entry. */
-};
+} ALIGN16_ATTRIB;
 
 
 struct cell_shader_info

src/mesa/pipe/cell/spu/spu_main.c

@@ -394,8 +394,8 @@ cmd_batch(uint opcode)
          pos += (1 + sizeof(struct pipe_viewport_state) / 4);
          break;
       case CELL_CMD_STATE_VS_ARRAY_INFO:
-         cmd_state_vs_array_info((struct cell_array_info *) &buffer[pos+1]);
-         pos += (1 + sizeof(struct cell_array_info) / 4);
+         cmd_state_vs_array_info((struct cell_array_info *) &buffer[pos]);
+         pos += (sizeof(struct cell_array_info) / 4);
          break;
       default:
          printf("SPU %u: bad opcode: 0x%x\n", spu.init.id, buffer[pos]);