I don't have a reasonable test case for this at the moment, though one wouldn't be that hard to develop given the description below.

Given the following sequence:

 1) Create a texture

      glGenTextures (1, &tex);
      glBindTexture (GL_TEXTURE_RECTANGLE_ARB, tex);
      glTexImage2D (GL_TEXTURE_RECTANGLE_ARB, 0,
                    GL_RGBA, width,height,
                    0, GL_BGRA, GL_UNSIGNED_BYTE,
                    NULL);

 2) Bind it as the color buffer:

      glGenFrameBuffersEXT (1, &fbo);
      glbindFramebufferEXT (GL_FRAMEBUFFER_EXT, fbo)
      glFramebufferTexture2DEXT (GL_FRAMEBUFFER_EXT, GL_COLOR_ATTACHMENT0_EXT,
                                 GL_TEXTURE_RECTANGLE_ARB, tex, 0);

 3) Render to it

 4) Switch back to rendering to the default rendering target

      glBindFramebufferEXT (GL_FRAMEBUFFER_EXT, 0)

 5) Create another texture:

      glGenTextures (1, &tex2);
      glBindTexture (GL_TEXTURE_RECTANGLE_ARB, tex2);
      glTexImage2D (GL_TEXTURE_RECTANGLE_ARB, 0,
                    GL_RGBA, width,height,
                    0, GL_BGRA, GL_UNSIGNED_BYTE,
                    NULL);

Then what happens with the command buffer is:

 3) State and rendering instructions are emitted into the command buffer.
    r300ValidateBuffers results in radeon_cs_space_add_persistent_bo()
    being called to add the texture target as a persistent bo to the
    CS object.
   
 4) radeon_bind_framebuffer calls radeon_draw_buffer() which eventually calls:

        _mesa_reference_renderbuffer(&radeon->state.color.rb, &rrbColor->base);

 5) radeon_teximage() calls radeon_firevertices(), which calls radeonFlush()
    which calls radeonEmitState(), which calls radeonEmitAtoms(), 
    which calls emit_cb_offset(), which calls:

        OUT_BATCH_RELOC(offset, rrb->bo, offset, 0, RADEON_GEM_DOMAIN_VRAM, 0);

   But rrb->bo is the *new* bo we are rendering to, which hasn't 
   seen a call to r300ValidateBuffers() since the last radeon_cs_emit().
   So the assertion in cs_gem_write_alloc()

    assert(bo->space_accounted);

   fails.

The fix I'm not at all sure of:

 - Is it OK to use one command buffer with multiple rendering targets? should the code always be flushing when switching rendering targets?

 - Why is state being emitted when flushing the command buffer - isn't it too late - state has to be emitted before rendering, and any left-over state changes shouldn't matter or need to be included in the command buffer?

 - Is it simply a missing call to r300ValidateBuffers somewhere?