Re: I once designed an OS configuration totally immune to malware
Ah, like my "diagnostics" flash drive. I use a SDMMC card in a card-to-USB converter.
Caution #1: The executing OS might be compromised; if it is, just reboot. The source OS probably won't be compromised (see below).
Caution #2: Many SDMMC-card-to-USB converters ignore the "read-only" switch on the SDMMC card. I had to buy quite a few converters 'till I found one which did/does respect the lock switch.
Caution #3: SDMMC-card-to-USB converters contain a microcontroller, which may be compromisable. Using a CDROM or DVD burned in TAO mode and run from a portable drive would be safer, though less-convenient.