The config is per disk and is inserted at offset 0x420 (0x20 into block 2) into the PSISOIMG section of the eboot.pbpDo we know where in the eboot.pbp the config is injected? I'm guessing it's in the "simple" module ("complex" in psx2psp), the prx embedded in the eboot.
I'll be reverse engineering and toying around with the simple.prx module and pops in general to try to get it working on devkits, might as well try to get custom external config while I'm at it.
https://www.psdevwiki.com/psp/PSISOIMG0000
The first two uint32_t are the version of PSP and for VITA that the configs that follow apply to.
This is where pop-fe injects the psp+vita / ps3 configs into offset 0x20 of block 2 of PSISOIMG
https://github.com/sahlberg/pop-fe/blob/7c0dc31869dcb735d4f4444cf49f0c97b7196d80/popstation.py#L2726
(ps3 configs use a different variable length format)