Or anything that runs libreboot: https://libreboot.org/docs/hcl/
If OpenBSD runs on it that's also a good sign usually as they won't touch anything with BLOBs.
Not a ready drop-in replacement yet, but running ARM code with access to the SD card and the UART console is possible!
edit: By the way! The Pi loads all the firmware from the SD card — no reflashable memory on the board AFAIK – which would make it excellent from the "State considered harmful" perspective http://blog.invisiblethings.org/2015/12/23/state_harmful.htm...
The GPU firmware runs in parallel to the CPU and has access to the complete memory. Video decoding is done by the GPU and happens while the CPU is completely idle. And it can (of course) crash. If you've done anything related to OMX programming on the Pi, you might have experienced that.
In theory there is nothing that would prevent the a rogue firmware from hooking into kernel structures to interface with the outside world.