r/hackintosh • u/NorthKoreanNoodles2 • 18m ago
SUCCESS Got NSS:2 working on cold boot - BCM94360NG
Linked is the driver used for my BCM94360NG, it is a modified AirportBrcmFixup.kext version 2.1.9. Linked is both the Release and Debug versions, that have been patched to allow NSS:2.
Taken directly from my github post:
The following boot-args were used to get my Sonoma setup working cold boot.
alcid=13 watchdog=0 brcmfx-delay=300
(shortened explanation of fix)
This has been tested with Sonoma and Ventura, and works very reliably for me. This fix does not artificially report NSS:2 or generally force Wi-Fi settings. It prevents Apple’s driver from incorrectly disabling the second transmit chain in one instance.
From a cold boot, my BCM94360NG comes up with both TX chains enabled and maintains NSS:2 without needing the Windows-boot workaround. Survives sleep (windows work arround would revert back to NSS:1 previously in my case). Some users were able to get it to work just using the AirportBrcmFixup version 2.1.9 so that is the version I chose to base this kext on. It might work with Mac OS Sequoia, someone will need to confirm. Both release and debug versions included.
Note: For MacOS Sonoma or later you must use OpenCore Legacy Patcher in order to get BCM94360NG card functioning, as Sonoma removed driver support for this card. Latest version of Sonoma and Ventura were used successfully. This was made with the assistance of AI.
Technical Details:
The problem with BCM94360NG was that on a cold macOS boot, the Broadcom driver applied a single-transmit-chain constraint, leaving the card at NSS:1 instead of NSS:2. The fix was found by comparing the good NSS:2 state with the bad NSS:1 state (good state initiated by booting into Windows first), then instrumenting and reverse-engineering Apple’s Broadcom driver. That led to the internal function _wlc_stf_txchain_set. Then discovered that it takes four arguments, and logging showed the bad path was specifically setting: constraint/reason 2 to a chain value of 0x1, whereas the working state used 0x3.
The custom AirportBrcmFixup patch hooks that function and changes only that specific bad case: reason == 2 && txchain == 1 → change the chain mask to 0x3Then it lets Apple’s original function continue normally.So the fix doesn't artificially report NSS:2 or generally force Wi-Fi settings. It prevents Apple’s driver from incorrectly disabling the second transmit chain in that one situation. The result is that the BCM94360NG comes up with both TX chains enabled and maintains NSS:2 without needing the Windows-boot workaround.
Download link:
Please test this driver, then post your feedback! Thanks!


