Created attachment 15699 [details]
GeForce 6600, DefaultDepth 16 set in xorg.conf, starting Firefox crashes X (always reproducible), and sometimes locks up the box entirely. Attached are xorg log with backtrace and fifo dump, and drm log. These are from a crash where the box did not lock up.
Created attachment 15700 [details]
Situation improved with commit 776670613f79cce3891c65d2f688979767cd1e6d, but still crashes (later). The crash can be avoiding using xorg.conf option EXANoUploadToScreen.
The problem looks to be in the padding applied in NVAccelUploadIFC.
Should be fixed, please test.