> is this whitelist publicly available?

Not that I know of.

> I suppose it is somewhere inside Boot.img?

I don't know for sure where it is. I suppose it's in the graphics driver because there were cases of non-working but technically supported (going by the GPU type) graphics cards, where bigfoot (or was it cyfm?) requested the PCI ID from the card owners and sent them a new graphics driver which then worked with the cards.

> what such whitelist good for?

Maybe a MorphOS team member will answer this :-)