i spent a few minutes adding code to the loader to list
the non-indirect calls made by all functions in the 9pc kernel.

looking through the output (4453 lines), i suspect it
might look fairly well-structured but i can't be sure
because it's taking rather longer than i'd hoped
to assemble graphviz/dot to let me see it.
it relies on several other packages so i need to import those too.

free software but no free time.
something like that.