r300_simple_msaa_resolve used to patch srcsurf->pitch with the resolve
destination's tiling bits before passing the surface to the blitter.
That worked when set_framebuffer_state kept the same pipe_surface
pointer, so r300_get_nonnull_cb returned the patched object.
After the de-pointerization, r300_framebuffer_init creates a fresh
r300_surface from the pipe_surface template, discarding the pitch
modification. The hardware then uses the MSAA source tiling for
R300_RB3D_COLORPITCH0, leading to corruption.
Move the tiling override into r300_emit_fb_state and override the tiling
bits of COLORPITCH from the destination surface at emit time.
Fixes: 2eb45daa9c ("gallium: de-pointerize pipe_surface")
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/work_items/15303
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/41092>
416da54cce