A maintainer of ASDF answered that only the dependencies declared in 'depends-on' should be put in the generated asd file for the bundle.
Therefore my patch is not necessary, and concerning hdf5-cffi, the cffi-grovel system should be listed in both 'defsystem-depends-on' and 'depends-on'.
signature.asc
Description: PGP signature