Machine-learning (ML) decoders are increasingly used in quantum error correction (QEC) to process measured syndromes and determine corrective operations, making them a security-critical component of quantum computing control systems. This paper investigates physical power side-channel attacks against ML-based quantum error correction decoders. We study a Deep Q-learning convolutional neural network decoder for the distance-5 Surface Code running on an Arm Cortex-M4 microcontroller, instrumented with a ChipWhisperer Husky for power-trace acquisition. Using profiled power measurements associated with the first convolutional layer (CONV1) and the final fully connected layer (FC3), we evaluate whether an attacker can infer information about the errors processed by the decoder. Across three independent capture campaigns and five classifier seeds, the evaluated classifiers achieve up to 83.2% accuracy in identifying the faulty data-qubit label across 25 classes, compared with a 4% random-guessing baseline, and up to 84.6% accuracy in identifying the associated Pauli X or Z error type, compared with a 50% baseline. The FC3-associated power window provides higher qubit-localization accuracy than the CONV1-associated window under the evaluated protocol. We further investigate execution-time leakage across implementations configured for different Surface Code distances, demonstrating that timing characteristics can reveal information about decoder implementation parameters. These results highlight confidentiality risks in ML-based quantum error correction and motivate side-channel-resistant implementations of quantum computing control systems.