My question is whether this is allowed, whether the msgs array passed
to the i2c_transfer() function can have multiple msgs pointing to the
same buffer (the one into which the original page is first stored
with first i2c_msg and then restored from it in the last i2c_msg).

Sending the messages is serialized, so the buffers won't interfere. At
first glance, I think it would work this way. But it's late evening
here, so I will have another look again tomorrow.