Another idea would be to include the ucode in base. It seems that ath
   microcode has a similar license and we have it in base [0].

the license seems 3-clause UCB-alike to me.  what do others think?

i think we could just put it in base.
   
   Maybe this issue should be directed to board@ or core@.

yeah.

[0]: I've been told that by including it in CVS would be considered a
   modification. If this is true, we could make the binary file a C
   array, include that file in the CVS tree and then build the original
   binary file that way. IANAL. 
   
how does putting it CVS modify it?  i don't buy this at all.