Source 2 manages entities in indexed chunks inside CGameEntitySystem (client.dll + dwGameEntitySystem):

uintptr_t GetEntityByIndex(int index) {
    uintptr_t entityList = Read<uintptr_t>(clientBase + dwGameEntitySystem);
    if (!entityList) return 0;
    
    // Source 2 chunk indexing (512 entities per chunk)
    uintptr_t listChunk = Read<uintptr_t>(entityList + 0x10 + (8 * ((index & 0x7FFF) >> 9)));
    if (!listChunk) return 0;
    
    return Read<uintptr_t>(listChunk + 120 * (index & 0x1FF));
}

Iterate from 1 to 64 to retrieve all player controllers (CCSPlayerController).

From the controller, read m_hPlayerPawn and pass the handle into GetEntityByIndex to obtain the actual C_CSPlayerPawn pointer. Works perfectly.

The bitwise arithmetic ((index & 0x7FFF) >> 9) was the missing piece for my entity loop. Thanks!