In existing ML code (which should be cleaned up), stateobj_disp[1] is the same as YUV422_LV_BUFFER_DMA_ADDR (i.e. a pointer to current LV buffer). LiveView image (LV) is triple-buffered.
If we can find a similar stateobj for HD buffer, it will solve magic zoom problems in 60D and 600D; not sure if the same issue is present on 500D.
On 550D, that stateobj might be around 0x4c5c (found with mem-spy). But I wasn't able to find it neither on 60D, nor on 600D.