as microcode.dat is ~850KiB of hex, could it be added to CONFIG_PROTECT_MASK (or moved out of /etc) so dispatch-conf or similar doesn't try to diff it every time there's an update?
yes and no ... users are free to download their own microcode.dat and use that in place of the default ...
true. this is small enough to live with i think.