rt2x00 has 2KiB to 8KiB of 8051 code. ath9k_htc uses 52KiB to 72KiB of Xtensa code. Old Broadcom cards (reverse engineered) had a custom instruction set and ~96 KiB firmware (?), new ones are 200-600 KiB of ARM code. Intel is 148KiB to 692KiB, probably custom ISA. Marvell Libertas has 120 KiB in one of the firmwares (others implement more functionality on chip instead of doing it in the kernel).
Ralink firmware should be easiest to replace via reverse engineering. It probably doesn't have a third-party RTOS and its code can be easily disassembled: these were problems for Libertas firmware replacement. Kernel drivers might provide some useful information on what the hardware does (memory map, register documentation, load address for the firmware, or how to debug the firmware).
pgp_sKtRdcf49.pgp
Description: PGP signature
