r600: fix count for CB/DB target state