NVIDIA VBO ubyte bug?

I get weird behavior on NVIDIA 61.77 drivers on a Geforce 6800 GT if I use UNSIGNED_CHAR as my type for VBO element arrays. I use STATIC_DRAW to initialize the buffer and map it with WRITE_ONLY access to load the data.

It will work for a few draws (7-9) and then crash in the driver. I get a memory fault claiming that address 0x0…0 is being “read” as if the buffer object weren’t bound.

The same code works if I use UNSIGNED_SHORT (easy enough change) or if I map with READ_ONLY every frame. There must be some weird optimization going on behind the scenes.