By name and original description, the eslint rule no-unknown-ds-tokens is supposed to flag unknown ds tokens.

#76210 added something else: it will now also flag known token strings that aren't wrapped in var(), even in contexts where that would be incorrect.

Since both checks are in the same rule, it's not possible to ignore any false positives for the var() check without also ignoring the possibility that the token may be (or become) unknown in the future. It would be better for these to be separate rules so that one can be ignored without also ignoring the other.