I propose adding support for evaluating binvars to SendMessage() where 2 possible methods are:

method 1:
The dll would write the binvar name and offset & length of data requested to the mapfile and call SendMessage(hwnd, WM_MBINVAR_GET, [flags], [mapfile cnt])
to retrieve chunks of data from the named binvar via the mapfile with all the same error codes as the existing messages.

A requested length of -1 would mean from offset to the end.

An additional set of enhanced error flags could be added to indicate more data waiting & unknown binvar

Code
#define WM_MBINVAR_GET (WM_USER + 202)
#define MIRCF_UNICODE 8
#define MIRCF_ENHANCEDERRORS 16

bool getBinvarData(HWND mIRCHWND, WCHAR *szMapFileDataAsString, int MapCnt, WCHAR *szBinvarname, size_t start, ptrdiff_t length)
{
  wsprintf(szMapFileDataAsString, L"%s %d %d", szBinvarname, start, length);
  
  auto err = SendMessage(mIRCHWND, WM_MBINVAR_GET, MIRCF_UNICODE | MIRCF_ENHANCEDERRORS, MapCnt)
  // mapfile now contains binvar data.
  if (err == 0)
    return true;

  // handle errors...

  return false;
}

method 2:
The dll would write the binvar name to the mapfile and call SendMessage(hwnd, WM_MBINVAR_GET, [flags], [mapfile cnt])
to retrieve a pointer to the binvar data & data length as text in the mapfile (similar to how /drawdll passes HDC's)
this would also lock the binvar to stop it being deleted untill a matching WM_MBINVAR_RELEASE is sent with the same binvar name in the mapfile.

An additional enhanced error flag could be added to indicate unknown binvar

This version would allow the dll to directly read & modify the binvar data.

Code
#define WM_MBINVAR_GET (WM_USER + 202)
#define WM_MBINVAR_RELEASE (WM_USER + 203)
#define MIRCF_UNICODE 8
#define MIRCF_ENHANCEDERRORS 16

std::vector<uint8_t> getBinvarData(HWND mIRCHWND, WCHAR* szMapFileDataAsString, int MapCnt, WCHAR* szBinvarname)
{
  std::vector<uint8_t> vOut;

  wcscpy(szMapFileDataAsString, szBinvarname);

  const auto err = SendMessage(mIRCHWND, WM_MBINVAR_GET, MIRCF_UNICODE | MIRCF_ENHANCEDERRORS, MapCnt);
  if (err == 0)
  {
    auto pBinvarData = reinterpret_cast<uint8_t*>(wcstoumax(szMapFileDataAsString, nullptr, 10));
    auto szlen = wcschr(szMapFileDataAsString, L' ') + 1;
    auto iLen = wcstoumax(szlen, nullptr, 10);
    vOut.reserve(iLen);
    
    std::memcpy(vOut.data(), pBinvarData, vOut.size());

    wcscpy(szMapFileDataAsString, szBinvarname);
    SendMessage(mIRCHWND, WM_MBINVAR_RELEASE, MIRCF_ENHANCEDERRORS, MapCnt);
    return vOut;
  }

  // handle errors...

  return vOut;
}

Both these methods have their pros & cons with lots of work need to secure them etc...