At the beginning of lv_raw_dump on the M there is a call made to a function in ram (branch instruction). On 60D this function call is to ROM not RAM. We can use RAM_OFFSET to find the location of that function in rom (Canon firmware copies some functions to RAM and runs them there rather than running them directly from ROM).
#define RAM_OFFSET 0xFFA69590
This leads to this function in ROM:
FFA7A184: ldr r0, [pc, #808] ; 0xffa7a4b4: pointer to 0x404e4
FFA7A188: ldr r0, [r0, #68] ; 0x44
FFA7A18C: bx lr
This code loads 0x404e4 into register 0, then adds 0x44 to register 0, then it returns (register 0 is the return value). In C:
return 0x404e4 + 0x44;
On 60D:
FF0F8B8C: ldr r0, [pc, #732] ; 0xff0f8e70: pointer to 0x4ff8 FF25B020 FF25B360 FF25B3A4 FF25AF2C FF25B31C
FF0F8B90: ldr r0, [r0, #48] ; 0x30
FF0F8B94: ldr r0, [r0]
FF0F8B98: bx lr
Which is equivalent to:
return *(0x4ff8 + 0x30);
Then lv_raw_dump uses this return value as a pointer to the location of the raw buffer. The ML macro MEM() is simply a pointer dereference. So Canon firmware always keeps a pointer to the location of the raw buffer at 0x404e4 + 0x44 on the EOS M. The actual raw buffer may be dynamically allocated, but it's current address is always kept at memory address 0x404e4 + 0x44 (yes, this is a pointer to a pointer, on 60D, it's actually a pointer to a pointer to a pointer). I guess these buffer addresses are probably kept in static arrays or structs and the + 0x44 part is the array index or struct offset. If it is indeed a data structure, it might be interesting to look at and around 0x404e4 and see what else might be kept there.