FULLPIPE: Fix buffer overruns in scene27