operating system – Calling the entry point of a separate EFI file from a UEFI bootloader

A device path consists of one or more nodes. Every node is a struct with the same header but can contain different data after the header.
To iterate over the device path you have to advance Length bytes from the start of the header to get to the next one.
If the device path is valid, it is terminated with an end node of type 0x7F and subtype 0x01 or 0xFF. I have seen systems that use 0xFF as end node type, you might check for that as well.

You need to get the device path of the parent device (the partition from which your bootloader was loaded) via the EFI_LOADED_IMAGE_PROTOCOL protocol.
The field you need is DeviceHandle, use HandleProtocol or OpenProtocol to get the device path from this handle.

Create a copy of the device path, if you don’t want to use the helper functions you have to iterate over the device path nodes until you find the end node to get the length. You need to add some space to the copy, so you can insert a file path node.

Insert the file path node with the path to the efi file before the end node.

Call LoadImage with the new device path, and StartImage with the image handle returned by LoadImage.