sizeof(SG) = 16
sizeof(OS_CMDEXT) = 320
os_max_sg_descriptors = 18

sglist_cnt            bytes-written          buffer-size                  OOB
1                                16                  288                 -272
4                                64                  288                 -224
16                              256                  288                  -32
18                              288                  288                    0
19                              304                  288                   16
32                              512                  288                  224
64                             1024                  288                  736
256                            4096                  288                 3808
1024                          16384                  288                16096
65535                       1048560                  288              1048272

Overflowing sglist_cnt values: 6/10

psg[18] write offset = 320 (== sizeof(OS_CMDEXT))
Confirms psg[] is the LAST field of OS_CMDEXT; first OOB byte is byte 0 of the adjacent heap allocation.

CONFIRMED: hpt27xx_osm_bsd.c:724-728 loop iterates ccb->csio.sglist_cnt (u16, max 65535) times into a fixed 18-entry SG array, overflowing (sglist_cnt-18)*16 bytes into the adjacent M_DEVBUF slab. Trigger: XPT_SCSI_IO with CAM_SCATTER_VALID and sglist_cnt>18 via /dev/passN on an hpt27xx SIM.
RUN_EXIT=0