bhyve: Fix assignment of *niov2 in split_iov()

niov2 returns the number of entries in the iovec starting at offset
"offset".  Here we are unconditionally setting it to 1, which of course
isn't right.

Fixes:		a28cf86c41 ("bhyve/virtio: Rework iovec handling functions for efficiency and clarity")
Reported by:	Claude and Ada Logics
Reviewed by:	Hans Rosenfeld <[email protected]>
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D58625

usr.sbin/bhyve/iov.c

@@ -71,8 +71,8 @@ split_iov(struct iovec *iov, size_t *niov1, size_t offset, size_t *niov2)
 	}
 
 	/* The entry iov[count] needs to be split. */
-	*niov1 = count + 1;
 	*niov2 = *niov1 - count;
+	*niov1 = count + 1;
 	memmove(&iov[count + 1], &iov[count], sizeof(struct iovec) * (*niov2));
 	iov[count].iov_len = resid;
 	iov[count + 1].iov_base = (char *)iov[count].iov_base + resid;