corepower.c hardening for DF-4928 (Info):

1) probe(): reject non-Intel / non-family-06 CPUs explicitly instead of
   skipping the model whitelist (the skip-guard let the driver probe and
   attach-attempt, including a raw rdmsr at corepower.c:273, on the audit
   guest's family-0xf CPUID - see run.log).
2) attach(): use rdmsr_safe() for MSR_RAPL_POWER_UNIT, matching the
   rdmsr_safe pattern already used by corepower_try() everywhere else.

--- a/sys/dev/powermng/corepower/corepower.c
+++ b/sys/dev/powermng/corepower/corepower.c
@@ -159,6 +159,11 @@
 	if (resource_disabled("corepower", 0))
 		return (ENXIO);
 
+	/* RAPL MSRs exist on Intel family 06 CPUs only. */
+	if (cpu_vendor_id != CPU_VENDOR_INTEL ||
+	    CPUID_TO_FAMILY(cpu_id) != 0x06)
+		return (ENXIO);
+
 	cpu_model = CPUID_TO_MODEL(cpu_id);
 	cpu_family = CPUID_TO_FAMILY(cpu_id);
 
@@ -270,7 +275,8 @@
 		}
 	}
 
-	val = rdmsr(MSR_RAPL_POWER_UNIT);
+	if (rdmsr_safe(MSR_RAPL_POWER_UNIT, &val) != 0)
+		return (ENXIO);
 
 	power_units = __SHIFTOUT(val, MSR_RAPL_POWER_UNIT_POWER);
 	energy_units = __SHIFTOUT(val, MSR_RAPL_POWER_UNIT_ENERGY);