I wonder if any of the 9 characters are checksum (the example math indicates none is), or if the validation scan allows a search without one of the characters e.g AB1?3XYZ in case of sloppy writing.

If not, then the system relies on people being able to write 9 consecutive legible characters. With postal codes and addresses it’s less fragile because the context helps disambiguate (a last name helps a postman tell if a street address has a 7 or 1)