Off-by-one OOB write in hdaa_pcmchannel_setup: ch->io[ret] = -1 with ret==16 writes one nid_t past nid_t io[16]

Summary

The converter-collection loop iterates i=0..15 and can increment ret once per i (16 distinct, valid, enabled, PCM-capable converters in one association - expressible by a hostile codec with up to 255 subnodes; duplicates are deduped and the i==15/hpredir skip happens after io[ret++]). With ret==16 the terminator write ch->io[ret] = -1 writes index 16 of nid_t io[16] - 4 bytes past the array. The write lands on the immediately following struct members stripecap/stripectl (+padding) because they trail io[] in struct hdaa_chan, so no memory-safety boundary is crossed: it clobbers stripecap to 0xff (stripe over-advertisement to the codec; stripectl is recomputed before use). Defense-in-depth fix only (guard ret < nitems(io)). Source-proven; not guest-verified (Info - skipped per contract).