Extra2 segment size is stored as 2-byte in 3 places:

1. by offset 4 in FRM header;
2. by offset 6 in FRM header as position to key information (disk_buff);
3. in the beginning of Extra2 segment.

disk_buff is at 2 bytes address stored in 2.
forminfo is at 4 bytes address stored after extra2
strpos is at forminfo + FRM_FORMINFO_SIZE + "length of all screens"
recpos is at 3 bytes address stored in strpos + 5

So after "disk_buff" there can be Extra3 segment as next segment "forminfo" is addressed by 4 bytes.