########## FINAL RUN DF-3955 (analysis)
DF-3955 radeon kv_dpm double-free on parse-OOM path (simulation)
kv_parse_power_table :2673-2677 kfree(dpm.ps), no NULL, num_ps stays 0
kv_dpm_fini          :2868      kfree(dpm.ps) AGAIN + ps_priv leak
gate: kzalloc(sizeof(struct kv_ps)) fails mid-loop (boot, KV APU)
state 2: kzalloc(kv_ps) failed -> kfree(dpm.ps); return -ENOMEM
dangling dpm_ps = 0x8004a16c0 ; leaked ps_priv count = 2 ; num_ps = 0
NON-CRASH MODE: stopping before the second free (leaked 2 kv_ps objects on purpose)
ANALYSIS_EXIT=0
########## FINAL RUN DF-3955 (crash)
DF-3955 radeon kv_dpm double-free on parse-OOM path (simulation)
kv_parse_power_table :2673-2677 kfree(dpm.ps), no NULL, num_ps stays 0
kv_dpm_fini          :2868      kfree(dpm.ps) AGAIN + ps_priv leak
gate: kzalloc(sizeof(struct kv_ps)) fails mid-loop (boot, KV APU)
state 2: kzalloc(kv_ps) failed -> kfree(dpm.ps); return -ENOMEM
dangling dpm_ps = 0x8004a16c0 ; leaked ps_priv count = 2 ; num_ps = 0
SECOND FREE COMPLETED SILENTLY (userland no-abort; kernel: silent heap corruption)
CRASH_EXIT=0