Adding an extra SC_DEBUG to dev/scsipi/cd.c just before the first
call to bounds_check_with_mediasize() seems to show where the EINVAL
is coming from:

cdstrategy cd0(pciide0:1:0): 18432 bytes @ blk 7638228
bounds_check_with_mediasize(18432 bytes @ blk 7638228, 512, 30624)

The last argument to kern/subr_disk.c:bounds_check_with_mediasize is
the size in DEV_BSIZE sectors.

4 partitions:
#        size    offset     fstype  [fsize bsize cpg/sgs]
 a:   8419232         0    ISO9660       0              # (Cyl.    0 - 84192*)
 d:   8419232         0    ISO9660       0              # (Cyl.    0 - 84192*)

I think that size is in the right units, so the next question is where the
30624 comes from (cd->params.disksize512)..

Cheers,

Patrick