diff --git a/src/intel/blorp/blorp_genX_exec.h b/src/intel/blorp/blorp_genX_exec.h
index 8f26925e6cb..f41634703d1 100644
--- a/src/intel/blorp/blorp_genX_exec.h
+++ b/src/intel/blorp/blorp_genX_exec.h
@@ -60,7 +60,7 @@ blorp_alloc_vertex_buffer(struct blorp_batch *batch, uint32_t size,
 static void
 blorp_alloc_binding_table(struct blorp_batch *batch, unsigned num_entries,
                           unsigned state_size, unsigned state_alignment,
-                          uint32_t *bt_offset, uint32_t **bt_map,
+                          uint32_t *bt_offset, uint32_t *surface_offsets,
                           void **surface_maps);
 static void
 blorp_surface_reloc(struct blorp_batch *batch, uint32_t ss_offset,
@@ -946,7 +946,7 @@ static void
 blorp_emit_surface_states(struct blorp_batch *batch,
                           const struct blorp_params *params)
 {
-   uint32_t bind_offset, *bind_map;
+   uint32_t bind_offset, surface_offsets[2];
    void *surface_maps[2];
 
    const unsigned ss_size = GENX(RENDER_SURFACE_STATE_length) * 4;
@@ -954,15 +954,15 @@ blorp_emit_surface_states(struct blorp_batch *batch,
 
    unsigned num_surfaces = 1 + (params->src.addr.buffer != NULL);
    blorp_alloc_binding_table(batch, num_surfaces, ss_size, ss_align,
-                             &bind_offset, &bind_map, surface_maps);
+                             &bind_offset, surface_offsets, surface_maps);
 
    blorp_emit_surface_state(batch, &params->dst,
                             surface_maps[BLORP_RENDERBUFFER_BT_INDEX],
-                            bind_map[BLORP_RENDERBUFFER_BT_INDEX], true);
+                            surface_offsets[BLORP_RENDERBUFFER_BT_INDEX], true);
    if (params->src.addr.buffer) {
       blorp_emit_surface_state(batch, &params->src,
                                surface_maps[BLORP_TEXTURE_BT_INDEX],
-                               bind_map[BLORP_TEXTURE_BT_INDEX], false);
+                               surface_offsets[BLORP_TEXTURE_BT_INDEX], false);
    }
 
 #if GEN_GEN >= 7
diff --git a/src/mesa/drivers/dri/i965/genX_blorp_exec.c b/src/mesa/drivers/dri/i965/genX_blorp_exec.c
index 2e62c70ee67..47d509df2e1 100644
--- a/src/mesa/drivers/dri/i965/genX_blorp_exec.c
+++ b/src/mesa/drivers/dri/i965/genX_blorp_exec.c
@@ -104,20 +104,21 @@ blorp_alloc_dynamic_state(struct blorp_batch *batch,
 static void
 blorp_alloc_binding_table(struct blorp_batch *batch, unsigned num_entries,
                           unsigned state_size, unsigned state_alignment,
-                          uint32_t *bt_offset, uint32_t **bt_map,
+                          uint32_t *bt_offset, uint32_t *surface_offsets,
                           void **surface_maps)
 {
    assert(batch->blorp->driver_ctx == batch->driver_batch);
    struct brw_context *brw = batch->driver_batch;
 
-   *bt_map = brw_state_batch(brw, AUB_TRACE_BINDING_TABLE,
-                             num_entries * sizeof(uint32_t), 32,
-                             bt_offset);
+   uint32_t *bt_map = brw_state_batch(brw, AUB_TRACE_BINDING_TABLE,
+                                      num_entries * sizeof(uint32_t), 32,
+                                      bt_offset);
 
    for (unsigned i = 0; i < num_entries; i++) {
       surface_maps[i] = brw_state_batch(brw, AUB_TRACE_SURFACE_STATE,
                                         state_size, state_alignment,
-                                        &(*bt_map)[i]);
+                                        &(surface_offsets)[i]);
+      bt_map[i] = surface_offsets[i];
    }
 }