On AIX:

root@castor4## gdb /opt/freeware/bin/python3
...
(gdb) run -m pdb Pb.py
...
(Pdb) n
b'def'
> /home2/freeware/src/packages/BUILD/Python-3.8.5/32bit/Pb.py(35)<module>()
-> print(
(Pdb) n
> /home2/freeware/src/packages/BUILD/Python-3.8.5/32bit/Pb.py(36)<module>()
-> CFUNCTYPE(c_char_p, MemchrArgsHack2,
(Pdb)
Thread 2 received signal SIGINT, Interrupt.
[Switching to Thread 1]
0x090000000016426c in __fd_select () from /usr/lib/libc.a(shr_64.o)
(gdb) b ffi_call
Breakpoint 1 at 0x1217918
(gdb) c
...
(Pdb) n

Thread 2 hit Breakpoint 1, 0x0900000001217918 in ffi_call () from /opt/freeware/lib/libffi.a(libffi.so.6)
(gdb) where
#0  0x0900000001217918 in ffi_call () from /opt/freeware/lib/libffi.a(libffi.so.6)
#1  0x0900000001217780 in ffi_prep_cif_machdep () from /opt/freeware/lib/libffi.a(libffi.so.6)
#2  0x0900000001216fb8 in ffi_prep_cif_var () from /opt/freeware/lib/libffi.a(libffi.so.6)
......

(gdb) b memchr
Breakpoint 2 at 0x9000000001b0d60
(gdb) c
Continuing.

Thread 2 hit Breakpoint 2, 0x09000000001b0d60 in memchr () from /usr/lib/libc.a(shr_64.o)
(gdb) i register
r0             0x9000000001b0d60        648518346343124320
r1             0xfffffffffffc8d0        1152921504606832848
r2             0x9001000a008e8b8        648535941212334264
r3             0xa000000003669e0        720575940382845408
r4             0x64     100
r5             0x0      0
r6             0x9001000a04ee730        648535941216921392
r7             0x0      0
...
(gdb) x/s $r3
0xa000000003669e0:      "abcdef"

So:
 - the string is passed as r3.
 - r4 contains "d" = 0x64=100
 - but the size 7 is missing

Anyway, it seems that ffi does not pass the pointer, but values. However, the length 7 is missing. Not in r5, and nowhere in the other registers.