fix(macos): sanity-bound SMC CPU power so an unmapped chip can't show garbage

The SMC cluster keys are M3-Max-verified; a different Apple die could reuse the
keys for something else. Reject an implausible sum (NaN/Inf/negative/>200W) so
such a chip falls back to Unavailable instead of a wrong number. IOReport stays
first (covers all base dies), and Linux/RAPL + Windows/Scaphandre are untouched.

Author: kinncj

CHANGELOG.md

@@ -7,6 +7,17 @@ and the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [2.5.2] - 2026-07-02
+
+### Fixed
+- **Guard the Apple SMC CPU-power read against unmapped chips.** The SMC cluster
+  keys are verified on an M3 Max; on a different Apple die the same keys could
+  mean something else. `power.cpu` from SMC is now rejected if the sum is
+  implausible (NaN/Inf, negative, or > 200 W), so such a chip falls back to
+  Unavailable rather than showing a garbage number. IOReport stays the first
+  source (covers every base die), so this only affects the Pro/Max SMC fallback —
+  no change on Linux (RAPL) or Windows (Scaphandre).
+
 ## [2.5.1] - 2026-07-02
 
 ### Changed

app/internal/helper/smc_darwin.go

@@ -87,7 +87,10 @@ static double smc_read_key(const char *k, int *found) {
 */
 import "C"
 
-import "unsafe"
+import (
+	"math"
+	"unsafe"
+)
 
 // smcReadFloat reads a 4-char AppleSMC float key in watts. ok is true when the
 // key exists and read as a float (value may be 0); false when absent or the wrong
@@ -126,5 +129,11 @@ func smcCPUPower() (watts float64, ok bool) {
 			ok = true
 		}
 	}
-	return watts, ok
+	// Guard against a chip whose key layout differs: if these keys mean something
+	// else there, or a float misreads, refuse an implausible CPU figure (NaN/Inf,
+	// negative, or > 200 W) so we fall back to Unavailable rather than show garbage.
+	if !ok || math.IsNaN(watts) || math.IsInf(watts, 0) || watts < 0 || watts > 200 {
+		return 0, false
+	}
+	return watts, true
 }