A DDK produced from a master key comes from a one-way derivation, the DDK is never a variant of the HSM's master file key, and the master key serves no purpose other than producing DDKs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.