Actually, I figured out. If anyone else needs something similar,
https://github.com/koreader/koreader-base/issues/1202/ is a great read. On the other hand,
https://github.com/NiLuJe/FBInk/pull/47/files is a pure gold mine.
Apparently writing to the framebuffer itself is pretty much standard. You first need to obtain VarScreenInfo (0x4600) and FixScreenInfo (0x4602) using ioctl calls and parse the structs. FixScreenInfo has an SmemLen field which you can use to mmap either /dev/fb0 or the userspace library also tries to open /dev/graphics/fb0 if the first one fails. Finally, I can write grayscale pixels to the mapped fb0 based on the width, height (in VarScreenInfo) and lineLength (in FixScreenInfo).
But after doing all that I didn't see a thing. I knew from libinkview that I need to somehow trigger an update. Reverse engineering is really painful, because dynamically mapped functions are called with dynamically extracted values. Thanfully the FBInk implementation figured it out mostly for me. So we need to send MXCFB_SEND_UPDATE ioctl with certain flags. I would love to read more on details such as temp and dithering/waveform modes. For now I just hard-coded the values fbink used too.
Find the final piece of code here:
https://gist.github.com/Diniboy1123/...681ae887d10774
Works fine, displays the image on the screen. It's obviously not optimized at all, but I am glad I got it working. Hope it will be helpful to someone.