chunk 1: append 62 bytes at &msg[0] (in bounds, end=62)
chunk 2: append 62 bytes at &msg[62] (in bounds, end=124)
chunk 3: append 62 bytes at &msg[124] (in bounds, end=186)
chunk 4: append 62 bytes at &msg[186] (in bounds, end=248)
chunk 5: memcpy(&msg[248], chunk, 62) writes 54 bytes past msg[256] (offsets 256..309)
chunk 6: memcpy(&msg[227], chunk, 62) writes 33 bytes past msg[256] (offsets 256..288)
chunk 7: memcpy(&msg[227], chunk, 62) writes 33 bytes past msg[256] (offsets 256..288)
chunk 8: memcpy(&msg[227], chunk, 62) writes 33 bytes past msg[256] (offsets 256..288)

result: first OOB append at chunk 5; max spill 54 bytes past msg[256]
clobbered after msg[256]: curchunk_len=a5 curchunk_idx=a5 curlen=e3 have_somt=a5 have_eomt=a5 initial_hdr[0]=a5 up_req_recv.chunk[0]=a5