diff --git a/nouveau/pushbuf.c b/nouveau/pushbuf.c
index 0fd0c47..0c88a42 100644
--- a/nouveau/pushbuf.c
+++ b/nouveau/pushbuf.c
@@ -508,10 +508,12 @@ pushbuf_validate(struct nouveau_pushbuf *push, bool retry)
 
 		if (bref->packet) {
 			pushbuf_krel(push, bref->bo, bref->packet, 0, 0, 0);
-			*push->cur++ = 0;
+			*push->cur = 0;
+			push->cur++;
 			pushbuf_krel(push, bref->bo, bref->data, bref->flags,
 					   bref->vor, bref->tor);
-			*push->cur++ = 0;
+			*push->cur = 0;
+			push->cur++;
 		}
 	}
 
@@ -610,8 +612,9 @@ nouveau_pushbuf_del(struct nouveau_pushbuf **ppush)
 		while ((krec = nvpb->list)) {
 			kref = krec->buffer;
 			while (krec->nr_buffer--) {
-				unsigned long priv = kref++->user_priv;
+				unsigned long priv = kref->user_priv;
 				struct nouveau_bo *bo = (void *)priv;
+				kref++;
 				cli_kref_set(nvpb->base.client, bo, NULL, NULL);
 				nouveau_bo_ref(NULL, &bo);
 			}
@@ -709,8 +712,10 @@ nouveau_pushbuf_data(struct nouveau_pushbuf *push, struct nouveau_bo *bo,
 
 	if (bo != nvpb->bo && nvpb->bgn != push->cur) {
 		if (nvpb->suffix0 || nvpb->suffix1) {
-			*push->cur++ = nvpb->suffix0;
-			*push->cur++ = nvpb->suffix1;
+			*push->cur = nvpb->suffix0;
+			push->cur++;
+			*push->cur = nvpb->suffix1;
+			push->cur++;
 		}
 
 		nouveau_pushbuf_data(push, nvpb->bo,
@@ -739,7 +744,8 @@ void
 nouveau_pushbuf_reloc(struct nouveau_pushbuf *push, struct nouveau_bo *bo,
 		      uint32_t data, uint32_t flags, uint32_t vor, uint32_t tor)
 {
-	*push->cur++ = pushbuf_krel(push, bo, data, flags, vor, tor);
+	*push->cur = pushbuf_krel(push, bo, data, flags, vor, tor);
+	push->cur++;
 }
 
 int