Kernel panic via truncated performance-counter overflow mask

NULL pointer dereference in the Linux kernel allows local users to panic RISC-V systems by recording branch perf events. The RISC-V SBI PMU overflow handler sets a bit in an unsigned-long counter mask with the 32-bit expression 1 << idx, truncating high counter indexes before later mask processing. The demonstrated path requires local perf access and affected RISC-V PMU hardware; on a Sophgo SG2042, the bad mask reaches riscv_pmu_ctr_get_width_mask and causes a fatal kernel exception.