Summary

Every mutating dispatch entry takes smu_lock, but six do not - including pp_get_power_profile_mode, reachable by ANY user via the world-readable sysfs attribute. The pp_table write path holds smu_lock across amd_powerplay_reset whose backend_fini kfrees and NULLs hwmgr->backend before hw_init recreates it. An unlocked dispatch landing inside that window dereferences a NULL or just-freed backend - the profile-mode reader sprintf's backend fields to an unprivileged reader (NULL panic or freed-slab disclosure). Add smu_lock to the six entries + the missing pm_en check.