Found during a debugging session with configs prepared by NIT, but using a separately exported state path (different from that generated into those configs) for driver socket files.
Generally envvars have precedence over configs and built-in defaults. It was also a discrepancy that the driver did create sockets in NUT_STATEPATH but upsd did not look there (and it took a while to track down where it does look).