I did not improve much in my bios hacking amptempt (because I didn't have much time) however I think I found the region free value to change in the dreamcast flash.
at offset 0x1A000 where you see 00211Dreamcast (PAL flash) if you change the 2 (euro) to 8 or 9 it should get to region free (you will get a black swirl but unlike all the other unknown regions the cd-r will boot (all other regions that are not set (and get a black swirl) wont boot cd-r)
I only had time to test it under chankast ( I can't currently test it on my DC because I am dumping a GD-ROM) but it should work at least to boot cd-r on retail dreamcast units.
(and likely to be region free as the region that's set doesn't match the ones of IP.bin from any cd-r (0, 1 and 2 in flash)) (J, U and E in ip.bin)
Looks like a new region changer has to be made :p I hope you don't mind having a black swirl
P.S. To answer famillyguy, I am not much of an hardware modder, I am more into software hacking, but I know a lot of people who are very confident with hardware so once I get the bios hacked, I'll probably send my dreamcast to one of them to get it replaced. I have to hack the bios first though and I lack of time nowaday :/
I am interested by the cd-r version of the bios, can you ask the author (is it mark30001? ) if I can have it?
UPDATE: I have done some more tests, it seems that the regions are repeated to some values for instance X = Japan Y = USA and Z= Euro they all give a black swirl but are still not region free :/ I guess we need to hack the bios after all.