I was exploring some bmp vram stuff in the firmware when I came across the vram structure for the bmp vram.
I printed part of the structure with bmp_printf, you can see it here:
0xF39C is the pointer to the structure. I know this is a vram structure, because off_0x0 (FFA2520C) is a spot in rom which says "Vram Instance".
Also, if you remember that my previous finding for the vram buffer location was 0x589242, the pointer here is very close to this spot. It appears that the vram buffer starts at 0x589200, if you notice the data that says "22442244 22442244" etc, this looks a lot like bmp color information. But, if I set the bmp buffer to be located at 0x589200 in bmp.h, then the text offset is wrong on the screen (the X offset).
Odd.. Also Alex pointed out that I may be printing the fonts as twice their size since 8 bits is one pixel in modern dryos dslrs (where the color palette is 8-bit), but 8 bits is 2 pixels in the 5dc (since there are only 4 bits of colors).