Summary

psm_set_user_performance_state (pp_psm.c:203-232): line 214 *state=hwmgr->ps resets cursor BEFORE restart_search: label at line 216. When user requests Battery/Balanced and no entry matches, switch at 223 sets label_id=Performance goto restart_search at 227. Goto targets 216 AFTER the 214 reset so *state is NOT re-reset. At goto point *state already points one element past kcalloc(table_entries,size) array (loop 217-221 advanced past last slot). Second pass iterates table_entries more at OOB offsets (table_entries+i)*ps_size reading (*state)->classification.ui_label. Performance==5 (0b101) bitwise AND matches almost any 4-byte OOB value -> return 0 with *state deep OOB. OOB pointer propagates as new_ps to psm_adjust_power_state_dynamic -> power_state_management -> requested->hardware dereferenced and forwarded to phm_set_power_state -> GPU SMC clock/voltage programming. Trigger: echo battery > /sys/class/drm/cardN/device/power_dpm_state on ASIC with no Battery/Balanced state (common desktop dGPUs). Impact: OOB heap read tens of KB past allocation leaking adjacent slab (KASLR); OOB pointer used as multi-KB hardware struct consumed by SMC -> panic/GPU hang/misprogrammed clocks. AV:L/PR:H/AC/L, C:H/A:H. Fix: move *state=hwmgr->ps to AFTER restart_search: label.