TL;DR: the code tries bus accesses at known addresses and moves on if there is a failure or the read doesn’t match a known value.
The system almost certainly tries to detect the frame buffers it knows about by performing read probe at the known physical address of specific registers of the board(s) in question.
As an example, let’s follow how a bwtwo might get detected. First, the pre-compiled device list is consulted. For bwtwo on a sun3x, that’s here:
That instructs the device driver to attempt to probe the board at physical base address 0x50300000. At runtime that will result in ca->ca_paddr being set to 0x50300000 in this function, which will then attempt to peek a 32 bit value at that address to see if it reads back as a known constant for any of the various bwtwo/cg4 frame buffers that respond at this address.