diff --git a/rpcs3/Emu/Cell/PPUModule.cpp b/rpcs3/Emu/Cell/PPUModule.cpp
index 0d4e4adac0..eeda8bda24 100644
--- a/rpcs3/Emu/Cell/PPUModule.cpp
+++ b/rpcs3/Emu/Cell/PPUModule.cpp
@@ -1233,7 +1233,7 @@ static void ppu_check_patch_spu_images(const ppu_module<lv2_obj>& mod, const ppu
 
 				for (u32 search = index & -16, tries = 16 * 64; tries && search >= lower_bound && search < (upper_bound & -16); tries = tries - 1, search = advance_index < 0 ? utils::sub_saturate<u32>(search, 0 - advance_index) : search + advance_index)
 				{
-					if (seg_view[search] != 0x42 && seg_view[search] != 0x43)
+					if (data_span[search] != 0x42 && data_span[search] != 0x43)
 					{
 						if (search == 0 && advance_index <= 0)
 						{
@@ -1572,7 +1572,7 @@ struct prx_names_table
 				ppu_loader.error("Skipping PRX name registeration: %s, max=0x%x", name, max0 << 16);
 			}
 
-			for (u32 i = seg.addr >> 16; i <= max; i++)
+			for (u32 i = seg.addr >> 16; i < max; i++)
 			{
 				lut[i].release(ptr);
 			}
diff --git a/rpcs3/Emu/Cell/SPUCommonRecompiler.cpp b/rpcs3/Emu/Cell/SPUCommonRecompiler.cpp
index bc7190eaba..e694d44e75 100644
--- a/rpcs3/Emu/Cell/SPUCommonRecompiler.cpp
+++ b/rpcs3/Emu/Cell/SPUCommonRecompiler.cpp
@@ -1257,7 +1257,7 @@ void spu_cache::initialize(bool build_existing_cache)
 				{
 					new_entry = start_new;
 
-					while (new_entry < next_func && (ls[start_new / 4] < 0x3fffc || !spu_thread::is_exec_code(new_entry, { reinterpret_cast<const u8*>(ls.data()), SPU_LS_SIZE }, 0, true)))
+					while (new_entry < next_func && (ls[new_entry / 4] < 0x3fffc || !spu_thread::is_exec_code(new_entry, { reinterpret_cast<const u8*>(ls.data()), SPU_LS_SIZE }, 0, true)))
 					{
 						new_entry += 4;
 					}
@@ -2478,7 +2478,7 @@ std::vector<u32> spu_thread::discover_functions(u32 base_addr, std::span<const u
 				continue;
 			}
 
-			const u32 target = op_branch_targets(next, op)[0];
+			const u32 target = op_branch_targets(next, test_op)[0];
 
 			if (target == umax || addr + 4 == target || target == addr || std::count(addrs.begin(), addrs.end(), target))
 			{
diff --git a/rpcs3/rpcs3qt/debugger_frame.cpp b/rpcs3/rpcs3qt/debugger_frame.cpp
index 2c2ffbf220..4e5a01f8d8 100644
--- a/rpcs3/rpcs3qt/debugger_frame.cpp
+++ b/rpcs3/rpcs3qt/debugger_frame.cpp
@@ -1403,7 +1403,7 @@ void debugger_frame::OnSelectSPUDisassembler()
 
 		for (u32 passed = spu_base; passed < SPU_LS_SIZE; passed += 4096)
 		{
-			if (!vm::check_addr(spu_addr + passed))
+			if (!vm::check_addr(spu_addr + passed - spu_base))
 			{
 				if (passed == spu_base)
 				{