diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c
index 48f3a06..cc0acf7 100644
--- a/hw/vmware_vga.c
+++ b/hw/vmware_vga.c
@@ -1053,6 +1053,7 @@ static CPUWriteMemoryFunc * const vmsvga_vram_write[] = {

 static void vmsvga_save(struct vmsvga_state_s *s, QEMUFile *f)
 {
+    int i;
     qemu_put_be32(f, s->depth);
     qemu_put_be32(f, s->enable);
     qemu_put_be32(f, s->config);
@@ -1061,7 +1062,9 @@ static void vmsvga_save(struct vmsvga_state_s *s, QEMUFile *f)
     qemu_put_be32(f, s->cursor.y);
     qemu_put_be32(f, s->cursor.on);
     qemu_put_be32(f, s->index);
-    qemu_put_buffer(f, (uint8_t *) s->scratch, s->scratch_size * 4);
+    for (i = 0; i < s->scratch_size; i++) {
+        qemu_put_be32s(f, &s->scratch[i]);
+    }
     qemu_put_be32(f, s->new_width);
     qemu_put_be32(f, s->new_height);
     qemu_put_be32s(f, &s->guest);
@@ -1073,6 +1076,7 @@ static void vmsvga_save(struct vmsvga_state_s *s, QEMUFile *f)
 static int vmsvga_load(struct vmsvga_state_s *s, QEMUFile *f)
 {
     int depth;
+    int i;
     depth=qemu_get_be32(f);
     s->enable=qemu_get_be32(f);
     s->config=qemu_get_be32(f);
@@ -1081,7 +1085,9 @@ static int vmsvga_load(struct vmsvga_state_s *s, QEMUFile *f)
     s->cursor.y=qemu_get_be32(f);
     s->cursor.on=qemu_get_be32(f);
     s->index=qemu_get_be32(f);
-    qemu_get_buffer(f, (uint8_t *) s->scratch, s->scratch_size * 4);
+    for (i = 0; i < s->scratch_size; i++) {
+        qemu_get_be32s(f, &s->scratch[i]);
+    }
     s->new_width=qemu_get_be32(f);
     s->new_height=qemu_get_be32(f);
     qemu_get_be32s(f, &s->guest);