The TL;DR on this is "if eqiad is the active primary: if eqiad misses, and the request didn't arrive through codfw, do an Only-If-Cached request to codfw first before trying the applayer". This can be done in both directions simultaneously in the future active:active scenario as well. We already have datacenter-loop-prevention VCL to avoid issues with this, and the Only-If-Cached part would build on the same headers. Because the primaries have very resilient and relatively low-latency connectivity to each other, there's little downside to this approach. The upside is that requests coming directly into the frontends of a (or the) primary DC have access to remote cache contents in various cache-wipe scenarios.
I'm not sure this can be implemented sanely in Varnish 3, but it definitely can be in Varnish4 with how backend-side request-restart works. So it's best to block this until post-Varnish4.