My CD drive has a negative read offset and doesn't have the capability to read into the lead-out. As I understand it, there is no way to make a bit-perfect reproduction of the last track of any CD with my hardware. (Please correct me if I'm wrong.)

Since most audio disks aren't full, what prevents EAC (and other rippers) from addressing sectors beyond the last track? If the last track were actually the second last track, the drive could easily be instructed to read the following sectors. Couldn't the lost samples of a last track be recovered by addressing a ficticious track after the actual last track?

EAC has by default an option enabled that will padd the missing samples with silence. This means that if the CD you're ripping ends with atleast the same amount of null samples as your read offset correction value, then you will get an extraction that's identical to one made with a drive supporting overreading. In cases where the CD dosen't end with silence, then you will loose those samples and get them replaced with null samples. However, the missed samples will just be low-level background noise from the recording studio and not real music. If i where you, then i wouldn't worry about overreading, and instead just concentrate on getting a secure rip

The discs TOC defines how many tracks there is on the disc and where the last track ends and EAC can't change that. EAC just instructs the drive to read samples after that point(if overreading is enabled) and then if the drive dosen't support overreading, then it will either return an error or simply return null samples.