(replying to myself, sorry if inappropriate)

Possibly also relevant, previous HN discussion on another vulnerability on AMD's PSP, reported and fixed in December 2017 (but only disclosed in January 2018):

https://news.ycombinator.com/item?id=16081141

Just FYI: you can edit your original comment, which is likely the better method in the future.