--- psp.orig	2026-09-23 11:51:37.384179718 +0000
+++ psp.fixed	2026-09-23 11:51:54.859951467 +0000
@@ -396,6 +396,18 @@
 	return 0;
 
 failed_mem:
+	/*
+	 * DF-4767: release everything allocated above the failing step.
+	 * amdgpu_bo_free_kernel() is NULL-safe and clears the pointers,
+	 * so psp_hw_fini()/retries cannot double-free.
+	 */
+	if (psp->km_ring.ring_size)
+		psp_ring_destroy(psp, PSP_RING_TYPE__KM);
+	amdgpu_bo_free_kernel(&psp->asd_shared_bo,
+			      (u64 *)&psp->asd_shared_mc_addr,
+			      &psp->asd_shared_buf);
+	amdgpu_bo_free_kernel(&psp->tmr_bo, (u64 *)&psp->tmr_mc_addr,
+			      &psp->tmr_buf);
 	amdgpu_bo_free_kernel(&psp->cmd_buf_bo,
 			      (u64 *)&psp->cmd_buf_mc_addr,
 			      (void **)&psp->cmd_buf_mem);