PowerVR DevmemIntChangeSparse2() Use-After-Free

PowerVR suffers from a DevmemIntChangeSparse2 use-after-free condition on a PMRGetUID call...