When I look at the documentation about identify words 60-61(total number of addressable sectors, capped/limited to 2^28-1) and ATA/ATAPI-6 words 100-103 (maximum user LBA address for 48-bit feature set) I see an error:
Both fields say "contain a value that is one greater than the [maximum LBA address in used address space/total number of user addressable sectors]".

If it's capped at the 2^28-1(field at word 60-61) or 2^48-1(field at word 1oo-103) value, the final sector in said range would never be addressable, as the value reported to software is capped to the maximum to fit in those bits (so all ones filling 28 or 48 bits).

The only way the 28-bit LBA can be fully addressable is to make this field be the maximum effective valid LBA address instead of it reporting 1 more than the disk size (causing an overflow, losing the final sector at disks larger or equal than 2^28 sectors (137GB limit error) or 2^48 (48-bit limit error).

Anyone knows the truth about this?