378e0c5c8967 reduced the number of playback channels from 5 to 1. This
introduced a regression, because the global DMA buffer indexing was not
adapted accordingly, which now results in kernel panics because of
out-of-bounds reads into the buffer. Additionally, because of wrong
indexing, recording channels ended up being serviced by the playback
part of envy24ht_intr().

Register 1 recording channel instead of 2 + sc->adcn, as the recording
DMA buffer only has room for 1 stereo stream. With 1 channel per
direction, give each channel the first index of its direction
(ENVY24HT_CHAN_PLAY_DAC1 and ENVY24HT_CHAN_REC_ADC1).

While here, fix the buffer wrap in envy24ht_r16sl(). It has to be
ch->size / ch->unit, but was copied verbatim from the 32-bit equivalent,
whose samples are twice as large, so 16-bit recording wrapped halfway
through the DMA buffer and never read the second half.

Fixes: 378e0c5c8967
PR: 299952
MFC after: 1 week
Sponsored by: The FreeBSD Foundation