Local privilege escalation via group creation race

Use-after-free in the Linux Panthor DRM scheduler allows local users with render-node access to corrupt kernel memory via concurrent ioctls. GROUP_CREATE publishes a group pointer in the pool Xarray before creation finishes, so a racing GROUP_DESTROY can free it while GROUP_CREATE still dereferences it. An unprivileged process with Panthor render-node access can exploit the predictable handle race for kernel-memory disclosure, corruption, control-flow hijacking, or a kernel panic.