Double free of adev->pm.dpm.ps on allocation-failure path in si_parse_power_table (plus leak of already-parsed si_ps states)

Summary

If the kzalloc(sizeof(struct si_ps)) inside the state loop fails, si_parse_power_table frees adev->pm.dpm.ps and returns -ENOMEM without nulling the pointer or setting num_ps; the error propagates to si_dpm_sw_init's dpm_failed -> si_dpm_fini, which kfrees adev->pm.dpm.ps again - double free. The ps allocations for earlier iterations leak (num_ps==0 hides them from the fini loop). OOM-gated (requires the kzalloc to fail mid-probe), so attacker control is indirect via memory pressure during boot/module load on SI hardware. Narrow trigger, hence Low. Upstream-identical. Verification skipped (Low, OOM-gated; contract permits).