Logged In: YES
user_id=4771
I'm confused: the rule for negative slot offsets appear to be different to the one for tp_dictoffset, which only increases the amount of obscurity around here.
tp_dictoffset counts relative to the end of the object, whereas in your patch negative slot offsets are a different trick to mean "relative to the start but skipping the varsized part". The difference shows up when subclassing increases tp_basicsize. This should be resolved one way or the other -- and I think that a clear picture of the various parts of the object and how they are measured would be a good start.
That's also related to your proposed change to extra_ivars(), which would become slightly more permissive; I strongly suspect that it would allow more strange segfaulting cases to sneak in undetected...