Logged In: YES 
user_id=4771

I'm confused: the rule for negative slot offsets appear to be different to the one for tp_dictoffset, which only increases the amount of obscurity around here.

tp_dictoffset counts relative to the end of the object, whereas in your patch negative slot offsets are a different trick to mean "relative to the start but skipping the varsized part".  The difference shows up when subclassing increases tp_basicsize.  This should be resolved one way or the other -- and I think that a clear picture of the various parts of the object and how they are measured would be a good start.

That's also related to your proposed change to extra_ivars(), which would become slightly more permissive; I strongly suspect that it would allow more strange segfaulting cases to sneak in undetected...