diff --git a/.pick_status.json b/.pick_status.json
index 2a0318efaaf..cba00123a1b 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -184,7 +184,7 @@
         "description": "lavapipe: don't crash on null xfb buffer pointer",
         "nominated": true,
         "nomination_type": 0,
-        "resolution": 0,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": null
     },
diff --git a/src/gallium/frontends/lavapipe/lvp_execute.c b/src/gallium/frontends/lavapipe/lvp_execute.c
index ce5e6bdf976..4cb05e3ef69 100644
--- a/src/gallium/frontends/lavapipe/lvp_execute.c
+++ b/src/gallium/frontends/lavapipe/lvp_execute.c
@@ -3372,7 +3372,7 @@ static void handle_begin_transform_feedback(struct vk_cmd_queue_entry *cmd,
 
    memset(offsets, 0, sizeof(uint32_t)*4);
 
-   for (unsigned i = 0; i < btf->counter_buffer_count; i++) {
+   for (unsigned i = 0; btf->counter_buffers && i < btf->counter_buffer_count; i++) {
       if (!btf->counter_buffers[i])
          continue;
 
@@ -3392,7 +3392,7 @@ static void handle_end_transform_feedback(struct vk_cmd_queue_entry *cmd,
    struct vk_cmd_end_transform_feedback_ext *etf = &cmd->u.end_transform_feedback_ext;
 
    if (etf->counter_buffer_count) {
-      for (unsigned i = 0; i < etf->counter_buffer_count; i++) {
+      for (unsigned i = 0; etf->counter_buffers && i < etf->counter_buffer_count; i++) {
          if (!etf->counter_buffers[i])
             continue;