The vertex data itself is DMA'd from AGP to video ram, and then pointed to with the NV40_VB_POINTER command.
Rendering appears to be started by doing a NV30_BEGIN/END as normal, and then sending batches of vertices with 0x1814, and finishing with another NV30_BEGIN_END.
When arrays have mismatched data types, the proprietary driver seems to fall back on passing vertices in the command stream.