Fix a bug in hwpmc(4) callchain retrieval, for both user and kernel.

The array index for the callchain is getting double-incremented -- both in the
loop and the storing.  It should only be incremented in one location.

Also, constrain the stack pointer range check.

MFC after:	2 weeks