Note this post doesn't fully answer my question.
I inspected the memory dump of a Debian installation. In detail, I inspected the Kernel Memory Space and manually inspected present code fragments. After inspecting code fragments, I found a reasonable amount of fragments in memory, which actually belong to a module (i.e. sky2.ko), which was NOT listed by lsmod or other logging mechanisms.
I tried to understand the functionality of LKMs and the presence of modules built inside the kernel itself. However, after checking every resource, grepping all the logs and try to understand possible dependencies, I can't answer when and where the LKM gets actually loaded into RAM.
Is there load/unload step which I do not consider? E.g. udev loads the LKM and discards it after several steps?
Could I resolve all cross loadings (e.g. by LKM dependencies) with lsmod, which does not seem so?
Is there a comprehensive resource, which lists all breakpoints of possible LKM loading?
Expectation : To my current understanding the fragments occur because of the initial ramdisk (see this great answers). However, how could I confirm my assumption?