What is the punishment for overfilling scuba cylinders?
There are multiple laws, regulations, and jurisdictions involved, so there is no simple answer.
Generally, the USDOT regulates the transportation of compressed gasses. It is a violation of the CFRs (code of federal regulations) to transport compressed gasses in interstate commerce in violation of the maximum fill limits. Fines up to $10,000 per occurrence can be assessed, in theory. All states incorporate the CFRs into state regulations in some form, and apply them to intrastate commerce as well. Possible fines vary from state to state.
Private use, unrelated to commerce, is outside the statutory authority of the USDOT. Commerce is broadly defined, so transportation on a for-hire dive boat, or for paid instruction, or a dive shop being paid for fills knowing the cylinders would be transported, would be covered by the regulations. The situation for private use under state law varies from state to state, with most states requiring pressure vessels not used in compliance with DOT regulations to meet other, generally more stringent requirements (such as posting bond, annual inspection by an engineer, an annual pressure vessel license, or an ASME approval stamp).
But enforcement is weak across the board. I'm not aware of any publicized cases.
If there's an accident and someone gets killed or even badly hurt, well, there are all kinds of opportunities for civil and criminal prosecution. If you read some of the liability cases that result in very large jury awards that are upheld on appeal, they look a lot like this --- someone engaging in an activity with known risks to the general public, on a for-hire basis, who has been trained and educated in safe practices, who then deliberately, egregiously, and routinely disregards those safe practices in order to make more money, resulting in an accident. It wouldn't even take a cylinder rupture. Someone crashing their divemobile into a minivan after a burst disc blew in the back seat would do it.
