Adding to Florian's answer above, I recently attempted some more reverse-engineering on this, which has led me to a lot of new information.

What SciPy calls the function_workspace is actually called the subsystem. The subsystem appears in the MAT-file as a normal variable of mxUINT8_CLASS, i.e., its written as a uint8 variable with just one caveat - this variable has no name. Whether the subsystem is present or not is indicated by a 64-bit integer in the MAT-file header. This integer is a byte marker pointing to the start of the subsystem data in the MAT-file.

Coming to its contents, the subsystem contains all necessary data required to construct object instances of mxOPAQUE_CLASS objects. This includes both user-defined classes (using classdef), as well as datatypes like string, datetime, table, etc.

The way it achieves this is by encoding instructions on object construction using methods of a class FileWrapper__. These instructions include information such as the class type, its properties and their values, and the construction order (in case of nested objects). Each constructed object is mapped to a unique object ID, which is used to link this constructed object to its corresponding variable when reading them in the normal portion of the MAT-file.

The exact format of the subsystem data is extremely convoluted to get into, I would refer you to my documentation which goes into it in great detail.