why could Darlington circuit protect Load Dump at automotive?
The Darlington pair in the circuit is always active, regardless of the spike on the supply rail: Q6 takes the base current through R16 (C99 along with R16 brings a crude soft start) and then provides its emitter current as a base current for Q9. This results in a voltage drop of 1.5~2 VDC (depending on the current draw) to the rest of the circuit.
I don't know the input voltage range of the circuit but I'm assuming that it's probably 9-16 VDC (i.e. UA-nom = 14VDC and UA-max = 16VDC). If so, according to ISO-16949 automotive electrical standard, the circuit will not see 18 VDC (temporarily extreme situation) during normal operation. Even if the circuit is designed for 18-32VDC (i.e. UA-nom = 28VDC and UA-max = 32VDC) D8 will never be in the Zener region during normal operation. But when the supply gets higher enough to make D8 in the Zener region (i.e. the load-dump state), the base voltage of Q1 will be ~33VDC and the rest of the circuit will see ~30-31 VDC for a short time. The protection shown in the circuit is a very dissipative method -- it's quite dissipative even for the normal operation.
When I was working in the automotive electronics industry, I used varistors along with resettable fuses for that purpose, even for UA=32VDC:



simulate this circuit &ndash; Schematic created using CircuitLab
RF (resettable fuse) should be selected according to the max operation current and max operating temperature (this can be as high as 85°C) as the trip current decreases as the temperature increases. Depending on the Class (i.e. test result - the circuit should operate as designed under Load Dump, or the circuit can stop temporarily during the Load Dump and should return to normal operation after the Load Dump, etc) the RF can be omitted.