Where do absent dots (`...`) get processed?

They're not explicitly passed to .Internal, but I believe they're available to do_lapply (in src/main/apply.c) via dynamic scope. The scoping rules may be slightly different than usual, since .Internal is a primitive function.

You can see that ... (R_DotsSymbol) is added to the function call lapply creates, so they're available to the function call on each list element. tmp is roughly equivalent to X[[i]] and R_fcall is roughly equivalent to FUN(X[[i]], ...).

SEXP tmp = PROTECT(LCONS(R_Bracket2Symbol,
        LCONS(X, LCONS(isym, R_NilValue))));
SEXP R_fcall = PROTECT(LCONS(FUN,
             LCONS(tmp, LCONS(R_DotsSymbol, R_NilValue))));