The loader doesn't have direct access to the filesystem containing an ICD. Instead, it must connect to the Vulkan loader service at /svc/fuchsia.vulkan.loader.Loader. That service can provide an executable VMO for an ICD, which can be loaded using dlopen_vmo.
According to the Fuchsia system ABI, Vulkan ICDs cannot directly use the filesystem to read files or connect to services. Instead loader will call the vk_icdInitializeOpenInNamespaceCallback function in the ICD immediately after the ICD is dlopened. The callback may be used by the ICD to connect to services, or the driver device node or to read from files.
If an ICD tries to open a path under /loader-gpu-devices using vk_icdInitializeOpenInNamespaceCallback, the loader will redirect that request to a directory returned by fuchsia.vulkan.loader/Loader.ConnectToDeviceFs. This allows the loader service to ensure all devnodes the ICD needs are accessible to it, without the application or application runtime needing to special-case device nodes in the application's component manifest.
ICD manifests are retrieved using ConnectToManifestFs on the loader service instead of being read directly from the filesystem. This allows ICD manifests to be packaged alongside the ICD shared library. Layer manifests are read from the filesystem like normal.