Ok... flight boxes are definitely stored in the AFBO chunk. So start from CGUnit_C__PlayFlightBoundsFeedback, I'll go through it too and will post my findings.
Edit: Rubbish... ADT v23 isn't used in release. But nonetheless it's the right track. And of course, you could simply parse the MFBO chunk of the adt. But where is the fun in that?
Edit2: Okay, they compute the adt tile coordinate of your position and then calculate the maximum z which is allowed based on the planes given in MFBO. I don't know if they are unmodified or a z offset is added while parsing the adt... regardless, MFBO provides you with 2 planes à 3*3 z values (in a grid). They compute in which quarter of the adt you are and then perform the z calculation based on the plane equation... basically z = -(x*n1 + y*n2 - d) / n3, where (x, y, z) is the player's position (or rather his highest/lowest possible position at (x, y)). (n1, n2, n3) is the plane's normal of length 1. d is a value which you get if you solve the equation for a point in the plane (basically, a distance measurement to (0,0,0)). This is math, so look here. This is the easiest way I can think of (except for calling an ingame function).
Edit3: Ahh, you are injected... Then it is as simple as calling
Code:
BOOL __cdecl World::GetFlightBoundsUpper(const C3Vector& position, float& fbo)
at 0x7243C0 (not rebased).