Even with the simple case of ratehi=13 (the attack rate in register) and ratelo=0 (no rate scaling, so actual rate is 13*4=52), so the attack level changes one step per one sample, I cannot get your formula to match the actual levels used by the chip.
Also the period slows down by doubling the amount of samples when AR is decreased by 1, so when AR=1 one level of attack envelope stays for 4096 samples. No intermediate values are used.
The only formula that will match the actual attack envelope levels is already on this forum, but I have only verified it when the envelope starts from silence, I have not verified when attack starts during release phase and envelope is not silence.
I repeat this from my memory: silence is integer 511, formula for next step at AR=13 is env=env-trunc(env/8)-1 which most likely matches env=env+(~(env>>3)), as the subtraction is done by summing with inverted bits so the value is larger.
Regarding your comment how the subtraction or sum can be reduced when taking a look at the (env>>(15-ratehi)) part, I think the chip does not sum or subtract 15 and ratehi to know how much to shift like computers do, most likely it just uses ratehi as offset where to start taking bits of env from, using muxes or perhaps delay lines when to start load in values. It might use "serial adders", who knows, but a lot of stuff inside the chip just seems to be shifting data left or right by some amount of bits, as sums and subtractions are also expensive.