The internet ate my whole post, lovely.
To recap it - writing the top of VRAM to >8370 before starting the DSRLNK does in fact work!
So, the trick of how to find the top of VRAM. Unfortunately we can't save it before the jailbreak overwrites it.
I think it might be enough to check just two possibilities. There's a header written at the beginning of the VDP buffer space. Assuming there is only one set of disk buffers (which I believe is true for all disk controllers, including systems with disk and RAMdisk. Not sure about hard drives), then our only variants are CF7 and TICC style. We can safely assume 3 files by telling people they must run the loader as the first and only thing they do in TI BASIC.
With that assumption, there are only two possibilities: >37D7 (TICC) and >37D1 (CF7). Add one and check VDP RAM for >AA - that's the signature byte. To be extra sure, add four to that, and check for >03 (number of files). If you get a match, that's the correct top of RAM. Write the original value into scratchpad at >8370 and it should work.
If you don't find either, the DSR doesn't use VDP RAM. Classic99 works like this, and though I heard of others that did (like the IDE controller), I think the others fake up VDP RAM so it looks normal. Anyway, for that case, I'd say to treat it as TICC mode and set >37D7.
If you want to be more flexible and try to search VDP, Thierry's notes are here, about halfway down: http://www.unige.ch/...ti99/disks2.htm
I didn't see much that looked promising for being /really/ flexible, though, I'd probably go with the two addresses version.