How do we know that i < size? For example, Ice Lake supports 4 fixed
counters, but fixed_pmc_events only has three entries.
We don't, and it's a preexisting bug in intel_pmu_refresh.
As Like points out, KVM_GET_SUPPORTED_CPUID indicates that only three
fixed counters are supported. So, per the KVM contract, if userspace
configures four in the guest cpuid info, all bets are off.
I don't like that contract, but changing it means introducing KVM_SET_CPUID3.