Double free of adev->pm.dpm.ps on the kzalloc-failure path of ci_parse_power_table (plus leak of already-parsed ci_ps states)

Summary

If the per-state kzalloc in ci_parse_power_table fails mid-loop, the error path kfrees adev->pm.dpm.ps and returns -ENOMEM without NULLing it; ci_dpm_init's error path then calls ci_dpm_fini(), which kfrees adev->pm.dpm.ps again - a double free (and the ps_priv allocations of states 0..i-1 leak, num_ps still 0). Triggerable by unprivileged users inducing kernel memory pressure during driver bind. OOM-condition double free -> allocator metadata corruption; realistically panic/hardening. Twin of amdgpu DF-3588 / radeon DF-3611. Fix: drop the inner kfree, set num_ps=i so fini releases parsed states. No pack (Low, OOM-timing dependent); source path certain.