Although I am no help it would be interesting to compare the last Rev 286 to the very first rev a’s that supposedly ran XMS faster.

The 286 had lots of errata passed off as features and certain functions disabled but partially left in the die.
As a result The 286 had a lot of unused (during normal operations) circuitry
It’s already known there was an in circuit emulator left on the die for testing and it’s believed the 30 bit virtual memory space was chosen due to errata.

There was someone who examined the 286 years ago that had a write up, life of me can’t find it.

286 licenses were widespread also, you'd think there might have been leakage from one of the dozen second sources. I guess bitsavers would have got it if it was well known though.

I don't think it would be possible to extract the microcode from that die shot at any resolution - I think the metal layer is intact. The lower layers need to be photographed to extract the ROM data. This was the situation with the 8086 too for a long time until Ken Shirriff published his die shots. Before that we had tantalising images of the 8086 die but only half of the bits were readable. That 286 shot doesn't appear to have any readable bits at all!

But I don't have any plans to figure out the microcode of later CPUs. For one thing, I'm not sure if enough information is available in the patents to do so even with a full ROM dump. The other problem is that 286 machines didn't run their CPUs from the same crystal as the PIT, so no software could ever depend on cycle-exact behaviour like it could on a 4.77MHz machine - that makes cycle-exact emulation of these machines much less interesting to me.