r300g: reference surfaces in set_framebuffer_state