Where I can read more about patching the original fw in flash?
In the firmware dump. I'd start with the WriteToRom and EraseSectorOfRom
eventprocs. You can find out how these functions are used from the canon crash log code.
I know it's dangerous but if done carefully it's the easiest way to change some constant without finding what task it belongs to.
Keep in mind that AFAIK no one here has actually done this. We've seen the functions, and decided not to brick our cameras.
Also keep in mind that many constants end up as immediate values that are scattered around the code, and that you can only write complete sectors. Writing a sector that happens to overlap with code the firmware is actually running would be a Bad Thing, since flash must be erased before writing. There might be other issues with this as well.
If you decide to go this route, I strongly suggest getting the cheapest used camera you can find. You may be able to find one that is broken in some way (cracked display, sensor problems etc) but still able to run.
Also, please document your experiences
Canon doesn't check the flash for changes/corruption, do they...?
As far as I can tell, they don't. The romstarter does check whether a firmware is present, but that just looks at the first few bytes. There are checksum functions, but I don't think they are called by in the normal boot process (but don't take my word for it!)