audio: another wrong struct that causes NULL pointer crash (thanks, Simon!).

Fixes Bugzilla #3632.
diff --git a/src/audio/SDL_audio.c b/src/audio/SDL_audio.c
index 45d137d..ae076b2 100644
--- a/src/audio/SDL_audio.c
+++ b/src/audio/SDL_audio.c
@@ -733,7 +733,7 @@
     const int data_len = device->spec.size;
     Uint8 *data;
     void *udata = device->spec.userdata;
-    SDL_AudioCallback callback = device->spec.callback;
+    SDL_AudioCallback callback = device->callbackspec.callback;
 
     SDL_assert(device->iscapture);