Ok, I'm with my two laptops here now.
In R_DrawBEntity, near the end, BSP models that aren't in a single leaf are sent to R_DrawSolidClippedSubmodelPolygons, to be clipped against the world.
In R_DrawSolidClippedSubmodelPolygons, the medge_t data from the model is copied to a bedge_t struct, and then the bedge_t data is passed to R_RecursiveClipBPoly along with the model's surfaces and nodes.
R_RecursiveClipBPoly clips the edges from the medge_t data, and apparently it stores the resulting edges into the local psideedges array. Since this function is recursive, it means that every time it's called, a new copy of psideedges is allocated, so the code can allocate exactly the required amount of RAM for the clipped edges, without ever knowing how many edges will be generated. This is why I couldn't find any data set for clipped edges before. After each finalized polygon is generated, it's sent to R_RenderBmodelFace.
R_RenderBmodelFace calls R_ClipEdge to clip the edges of the polygon against the screen, and stores the resulting data in the surf_t *surfaces list through the surface_p pointer. The surfaces list is allocated in R_NewMap through the line surfaces = Hunk_AllocName (r_cnumsurfs * sizeof (surf_t), "surfaces");
Why such a generic name was used for a global variable so important? I've had to search for surfaces[, *surfaces and surfaces = to be able to track the parts of the code that uses it.
Anyway, R_RenderBmodelFace doesn't do anything afterwards. The surfaces data is rendered through D_DrawSurfaces, which is called by R_ScanEdges, which is called by R_EdgeDrawing after all R_DrawSolidClippedSubmodelPolygons calls have been issued by R_DrawBEntitiesOnList, which R_EdgeDrawing had also called before.
Holy crap.