SH1106 - Transferring long buffer via SPI
You seem to have understood the following but just for clarification:

transfer16(uint16_t word), as the name implies, shifts 16bits/2bytes instead of just 8bits/1byte like transfer(uint8_t byte).

transfer(uint8_t* buffer, unsigned int size) on the other hand takes a pointer and the amount of bytes to shift.

Now to pointer arithmetic. Operations on pointer variables are dependent on their explicit data type(as well as processor architecture!). Therefore, in our case, a +1 on uint8_t* val will advance the pointer by 8bits.
+1 on uint32_t* val will do so by 4bytes/32bits.

Check buffer's data type

It should be any of char, unsigned char, uint8_t, int8_t