Hi. If I read the built-in function object part correctly, it seems that the built-in function object has only internal slots of ordinary object and [[Realm]], [[InitialName]] additionally.
But in MakeConstructor abstract operation, the F(a first argument) can be an ECMAScript function object or built-in function object, but F.[[ConstructorKind]] is set in step 3 when it can be built-in function object which is not available internal slot according to the definition of built-in function object.
Every built-in function object is required to have the ordinary slots plus [[Realm]] and [[InitialName]]. But it's not forbidden from having additional slots. And indeed, CreateBuiltinFunction takes a parameter by which the caller can specify additional slots for the particular function being created.
If you look at the invocations of MakeConstructor, you see that its argument is usually the result of a call to OrdinaryFunctionCreate (i.e., an ECMAScript function object). The only case where it isn't, i.e. where its argument might be a built-in function object, is in ClassDefinitionEvaluation. And there you can see that, in the case that _F_ is a built-in function, it's created by a call to CreateBuiltinFunction that includes [[ConstructorKind]] as an extra slot to create.