I had meant to add lots of comments to the FSAL API header about how all this handle-to-wire / wire-to-host / handle-to-key stuff works… (particularly the memory lifetimes and ownership) because I struggled with it when implementing the v3 proxy.
The giant comment in fsal_api.h is not bad, but the real action is in nfs_filehandle_mgmt.c (there are other callers of wire_to_host, including the mdcache just passing it through to the underlying FSAL, and an NFSv4 digest variant, but HandleMap_GetFH is being called on the "get me the v3 handle" path):
which shows that the buffer passed into wire_to_host is NFS3_FHSIZE long (which makes sense, the function is trying to compute an fh3 as output). The comment there incorrectly says "no larger than NFS4_FHSIZE" but it should say NFS3_FHSIZE. (How'd you get NFS4_FHSIZE+2?)