libqos: fix omap-i2c receiving more than 4 bytes

If more than 4 bytes are received, the FIFO cannot host the entire
contents of the transfer and STP will be nonzero before entering
the transfer loop.  Also, CNT will contain the number of bytes
left to be transferred instead of the total number of bytes in
the transfer.

(Reverse engineered from the omap_i2c.c source code; no available
datasheet).

This will fix ds1338-test for omap-i2c.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>