--- a/sys/dev/drm/radeon/sumo_dpm.c
+++ b/sys/dev/drm/radeon/sumo_dpm.c
@@ -1499,7 +1499,14 @@
 			return -EINVAL;
 		ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL);
 		if (ps == NULL) {
+			/* DF-4188: free the already-parsed ps_priv states and
+			 * NULL the array pointer; leaving it dangling makes
+			 * sumo_dpm_fini() double-free it after the (swallowed,
+			 * see radeon_pm.c DF-4162) init failure. */
+			for (i--; i >= 0; i--)
+				kfree(rdev->pm.dpm.ps[i].ps_priv);
 			kfree(rdev->pm.dpm.ps);
+			rdev->pm.dpm.ps = NULL;
 			return -ENOMEM;
 		}
 		rdev->pm.dpm.ps[i].ps_priv = ps;