Looking at g16 101c fw dump, I'd guess you have a raw buffer at
0x43bdce00 (and possibly 433cf100)
I'd confirm this by
con 1> !t={} con:execwait([[mem_search_word{start=0xfc020000, last=0xfe000000, val=0x43bdce00}]],{libs='mem_search_word',msgs=chdku.msg_unbatcher(t)})
con 2> !for i,v in ipairs(t) do printf("0x%08x\n",bit32.band(v,0xFFFFFFFF)) end
Which should give you a list of addresses to look at with rmem to see other raw buffers and the structure.
Good luck!