How to inspect the file system loaded in initramfs

Hi everyone,

I'm trying to debug a weird dropbear behavior by ruling out some hypotheses. For this, I need to access the filesystem loaded in initramfs. When I inspect the content of the image

cpio -idm < /boot/initramfs-linux.img
ls 

1  bin  early_cpio  lib  lib64  sbin  usr  var

I can find no signs of the SSH Host keys used by dropbear. Yet, I know they are used. At this point, they are two possibilities

1. Initramfs filesystem is actually contained in a binary or an archive (in ./usr? none of the Zstandard compressed data looked like an archive or a filesystem img to me) inside this very image.

2. The filesystem isn't contained in initramfs-linux.img but somewhere else

find /boot/  -type f 
/boot/vmlinuz-linux
/boot/initramfs-linux.img
/boot/EFI/systemd/systemd-bootx64.efi
/boot/EFI/BOOT/BOOTX64.EFI
/boot/loader/entries/2026-03-09_13-51-14_linux.conf
/boot/loader/loader.conf
/boot/loader/random-seed
/boot/loader/entries.srel

Here is the bootloader entry (standard systemd-boot EFI)

title   Arch Linux (linux)
linux   /vmlinuz-linux
initrd  /initramfs-linux.img
options cryptdevice=PARTUUID=d95be135-c170-4bae-ade5-45ea9c8fb562:root root=/dev/mapper/root rw rootfstype=ext4 ip=:::::eth0:dhcp

In the case of an Arch system using systemd-boot EFI, where does the fs used by vmlinuz-linux kernel come from?