Report from pahole on amd64 host:
struct TCXState {
	SysBusDevice               busdev;               /*     0  5648 */
	/* --- cacheline 88 boundary (5632 bytes) was 16 bytes ago --- */
	target_phys_addr_t         addr;                 /*  5648     8 */
	DisplayState *             ds;                   /*  5656     8 */
	uint8_t *                  vram;                 /*  5664     8 */
	uint32_t *                 vram24;               /*  5672     8 */
	uint32_t *                 cplane;               /*  5680     8 */
	ram_addr_t                 vram_offset;          /*  5688     8 */
	/* --- cacheline 89 boundary (5696 bytes) --- */
	ram_addr_t                 vram24_offset;        /*  5696     8 */
	ram_addr_t                 cplane_offset;        /*  5704     8 */
	uint32_t                   vram_size;            /*  5712     4 */
	uint16_t                   width;                /*  5716     2 */
	uint16_t                   height;               /*  5718     2 */
	uint16_t                   depth;                /*  5720     2 */
	uint8_t                    r[256];               /*  5722   256 */
	/* --- cacheline 93 boundary (5952 bytes) was 26 bytes ago --- */
	uint8_t                    g[256];               /*  5978   256 */
	/* --- cacheline 97 boundary (6208 bytes) was 26 bytes ago --- */
	uint8_t                    b[256];               /*  6234   256 */

	/* XXX 2 bytes hole, try to pack */

	/* --- cacheline 101 boundary (6464 bytes) was 28 bytes ago --- */
	uint32_t                   palette[256];         /*  6492  1024 */
	/* --- cacheline 117 boundary (7488 bytes) was 28 bytes ago --- */
	uint8_t                    dac_index;            /*  7516     1 */
	uint8_t                    dac_state;            /*  7517     1 */

	/* size: 7520, cachelines: 118 */
	/* sum members: 7516, holes: 1, sum holes: 2 */
	/* padding: 2 */
	/* last cacheline: 32 bytes */
};	/* definitions: 1 */

Fix by rearranging the structure to avoid padding.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>