The ARM dynamic linker should save and restore the call-clobbered NEON registers, d0-d7 and d16-d31, if they exist, in _dl_runtime_resolve and _dl_runtime_profile and the TLS descriptors code.  This requires runtime checks for whether the registers exist using HWCAPs (unless compiler predefines allow such checks to be elided).  (Likewise, for iWMMXt call-clobbered registers.)

For d0-d7 this is needed when built with the VFP ABI because they are used for argument passing in that case.  For all the call-clobbered registers, in all cases, this is needed because of restricted clobber sets for the TLS descriptor functions and for functions such as __aeabi_memcpy that may be called via the dynamic linker.

IFUNCs are the main practical way of triggering this issue, at least for the case of d0-d7.  It might be worth explicitly disabling VFP and iWMMXt for the dynamic linker if possible to avoid the cost of checking for and saving the other registers on every program execution to address what's a fairly theoretical issue - if the dynamic linker (including memcpy etc. called therein) never uses VFP or iWMMXt registers, then the only case needing extra register saving is the case of building for the VFP ABI, which needs to save d0-d7 only because of the IFUNC issue, with no dynamic checks needed.