lustre/osp/osp_trans.c::osp_prep_update_req()

	req_capsule_set_size(&req->rq_pill, &RMF_OUT_UPDATE_HEADER, RCL_CLIENT,
			     sizeof(struct osp_update_request));

	req_capsule_set_size(&req->rq_pill, &RMF_OUT_UPDATE_BUF, RCL_CLIENT,
			     buf_count * sizeof(*oub));

The first struct packed is actually a struct out_update_header with no inline data, so it should be packed as a length of 16, but gets packed as length 120 because of the size of struct osp_update_request (which should NEVER go over the wire).