ok stumbled on a raymond chen article:
https://devblogs.microsoft.com/oldnewthing/20180817-00/?p=99515

and now i understand... it's not va_list precisely, it's that using va_list causes the function to spill the registers. in reality, we're supposed to provide space for potential arg saves for the callee, _then_ the function subtracts from r1 (which raymond chen also mentions). this mirrors what i see in the prolog of sprintf