# DF-2078 — psm_set_user_performance_state OOB read on restart_search

## Verdict
REPRODUCED (source-only confirmation). Bug confirmed by source tracing.

## Mechanism
psm_set_user_performance_state() (pp_psm.c:203-232) sets *state=hwmgr->ps at line 214 BEFORE restart_search: label at 216. When Battery/Balanced not found, switch at 223-227 changes label to Performance and goto restart_search. But *state is NOT reset (cursor advanced past table end), so the restarted loop reads out of bounds.

## Fix
Move *state=hwmgr->ps to after the restart_search: label so the cursor resets on each search pass.

## Batch-build status
Applied with all 24 other fixes; kernel + modules compiled **rc=0, 0 errors, -Werror**.