Double-checked to make sure it wasn't a 64-bit issue:
cnt += __popcnt(*(DWORD*)buf) +
__popcnt(*(DWORD*)(buf + sizeof(DWORD) )) +
__popcnt(*(DWORD*)(buf + sizeof(DWORD) * 2 )) +
__popcnt(*(DWORD*)(buf + sizeof(DWORD) * 3 ));
000000013F231DF0 popcnt eax,dword ptr [r8+8]
000000013F231DF6 popcnt ecx,dword ptr [r8+0Ch]
buf += sizeof(DWORD) * 4;
000000013F231DFC add r8,10h
000000013F231E00 add ecx,eax
000000013F231E02 popcnt eax,dword ptr [r8-0Ch]
000000013F231E08 add ecx,eax
000000013F231E0A popcnt eax,dword ptr [r8-10h]
000000013F231E10 add r9d,eax
000000013F231E13 add r9d,ecx
000000013F231E16 dec rdx
000000013F231E19 jne POPCNT_HardwareUnrolled+50h (13F231DF0h)