Fix Broadcom Wi-Fi policy and kext selection

Author: redpersongpt

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Project note: the app is now branded as `OpCore-OneClick`. Legacy repo/update coordinates and the persisted app-data path remain unchanged for continuity.
 
+## 3.2.8 - 2026-04-03
+
+### Fix Broadcom Wi-Fi planning/generation drift
+- Stop auto-injecting `itlwm.kext` into modern laptops unless the detected Wi-Fi chipset is actually Intel. Broadcom laptops were incorrectly inheriting the Intel Wi-Fi path before.
+- Add a conservative Broadcom Wi-Fi policy: supported BCM4352/BCM43602 paths now pull in `AirportBrcmFixup.kext` on Ventura and older, while BCM4360 stays on the native-style pre-Sonoma path.
+- Sonoma and newer now report Broadcom Wi-Fi honestly in compatibility analysis instead of implying a clean native route where OCLP/root patches or a card swap are the real next step.
+- Add `AirportBrcmFixup.kext` to the app kext registries so the generated Broadcom Wi-Fi path is fetchable and visible in resource planning.
+
 ## 2.7.20 - 2026-03-23
 
 ### Global Network Auto-Retry and Auto-Resume

electron/compatibility.ts

@@ -11,6 +11,7 @@ import {
   hasUnsupportedDiscreteGpu,
   parseMacOSVersion,
 } from './hackintoshRules.js';
+import { getBroadcomWifiPolicy } from './wifiPolicy.js';
 
 export type CompatibilityLevel =
   | 'supported'
@@ -280,6 +281,17 @@ function buildCompatibilityNextActions(
     });
   }
 
+  if (report.warnings.some((warning) => /broadcom wi-fi/i.test(warning))) {
+    addAction({
+      title: 'Validate the Broadcom wireless path separately',
+      detail: report.warnings.some((warning) => /sonoma|sequoia|tahoe|root patches|oclp/i.test(warning))
+        ? 'This Broadcom Wi-Fi path is no longer a clean native route on newer macOS targets. Expect OCLP/root patches or a replacement card if wireless matters.'
+        : 'Broadcom Wi-Fi support on this card family is conditional. Confirm the exact card model, verify whether AirportBrcmFixup is enough, and treat Bluetooth as a separate check.',
+      source: 'rule',
+      confidence: 'medium',
+    });
+  }
+
   if (report.warnings.some((warning) => /discrete gpu/i.test(warning))) {
     addAction({
       title: 'Force the laptop onto the iGPU path',
@@ -429,6 +441,17 @@ function buildMostLikelyFailurePoints(
     });
   }
 
+  if (report.warnings.some((warning) => /broadcom wi-fi/i.test(warning))) {
+    addCandidate('broadcom-wireless', {
+      title: 'Broadcom Wi-Fi support path may still need manual validation',
+      detail: report.warnings.some((warning) => /sonoma|sequoia|tahoe|root patches|oclp/i.test(warning))
+        ? 'Newer macOS targets dropped this Broadcom path as a clean native route. Wireless may need OCLP/root patches or a replacement card even if the rest of the machine is bootable.'
+        : 'This Broadcom Wi-Fi family is only conditionally supported. Expect card-model-specific validation before you trust wireless or Bluetooth behavior.',
+      source: 'rule',
+      weight: report.warnings.some((warning) => /sonoma|sequoia|tahoe|root patches|oclp/i.test(warning)) ? 8 : 5,
+    });
+  }
+
   if (report.communityEvidence?.whatDidNotWork.some((item) => /thunderbolt/i.test(item))) {
     addCandidate('thunderbolt', {
       title: 'Thunderbolt or advanced I/O features',
@@ -515,6 +538,32 @@ export function checkCompatibility(
 
   report.communityEvidence = hasCommunityEvidence ? communityEvidence : null;
 
+  const broadcomWifiPolicy = getBroadcomWifiPolicy(profile.wifiChipset, profile.targetOS);
+  if (broadcomWifiPolicy?.supportClass === 'sonoma_root_patch') {
+    applyAdvisoryLevel(
+      report,
+      'risky',
+      'Broadcom Wi-Fi path detected. Sonoma and newer removed this as a clean native wireless route, so EFI planning can continue but wireless now depends on OCLP/root patches or a replacement card.',
+      `Broadcom Wi-Fi detected (${broadcomWifiPolicy.chipset}). Sonoma and newer are not a clean native path for this card family.`,
+    );
+  } else if (broadcomWifiPolicy?.supportClass === 'legacy_unsupported_on_target') {
+    applyAdvisoryLevel(
+      report,
+      'risky',
+      'Legacy Broadcom Wi-Fi path detected. The rest of the machine may still boot, but this wireless card family tops out around Catalina and should not be treated as a normal modern macOS path.',
+      `Broadcom Wi-Fi detected (${broadcomWifiPolicy.chipset}). This older card family tops out around Catalina and is not a normal ${profile.targetOS} wireless path.`,
+    );
+  } else if (broadcomWifiPolicy?.supportClass === 'unknown_broadcom') {
+    applyAdvisoryLevel(
+      report,
+      'experimental',
+      'Broadcom Wi-Fi path detected, but the exact chipset support is not modeled cleanly in the generator yet. Planning can continue, but wireless should stay an explicit manual-validation item.',
+      `Broadcom Wi-Fi detected (${broadcomWifiPolicy.chipset}), but the exact support path is not modeled yet.`,
+    );
+  } else if (broadcomWifiPolicy) {
+    pushUnique(report.warnings, broadcomWifiPolicy.summary);
+  }
+
   if (report.confidence === 'low') {
     applyAdvisoryLevel(
       report,

electron/configGenerator.ts

@@ -9,6 +9,7 @@ import {
     parseMacOSVersion,
     type HardwareGpuDeviceSummary,
 } from './hackintoshRules.js';
+import { classifyWifiChipsetFamily, getBroadcomWifiPolicy } from './wifiPolicy.js';
 
 // ── SIP Policy ──────────────────────────────────────────────────────────────
 // csr-active-config values, least-permissive first.
@@ -755,13 +756,14 @@ export function getRequiredResources(profile: HardwareProfile) {
             pushSsdt('SSDT-RHUB.aml');
         }
 
-        // Intel Wi-Fi: most laptops Skylake+ have Intel Wi-Fi cards.
-        // AirportItlwm provides native-like Wi-Fi including Recovery support,
-        // but requires SecureBootModel to be non-Disabled.
-        // Since we set SecureBootModel=Disabled for broad compat, use itlwm.
-        // itlwm uses the Heliport companion app and works without SecureBootModel.
+        // Intel Wi-Fi: only auto-select when hardware scan actually resolved an Intel card.
+        // The older blanket "modern laptop => itlwm" heuristic was wrong for Broadcom paths.
+        // Since we set SecureBootModel=Disabled for broad compat, use itlwm instead of AirportItlwm.
         // Source: Dortania ktext.html, OpenIntelWireless docs
-        if (['Skylake', 'Kaby Lake', 'Coffee Lake', 'Comet Lake', 'Ice Lake'].includes(profile.generation)) {
+        if (
+            ['Skylake', 'Kaby Lake', 'Coffee Lake', 'Comet Lake', 'Ice Lake'].includes(profile.generation)
+            && classifyWifiChipsetFamily(profile.wifiChipset) === 'intel'
+        ) {
             pushUnique('itlwm.kext');
         }
 
@@ -782,11 +784,11 @@ export function getRequiredResources(profile: HardwareProfile) {
     // Intel Bluetooth on Tahoe — Source: tahoe.html
     // (boot-arg -ibtcompatbeta handled in config generator boot-args section)
 
-    // Broadcom WiFi on Sonoma+ — Source: tahoe.html
-    // AppleBCMWLANCompanion brings back support without root patching (requires VT-d)
-    // Only for Intel systems since AMD doesn't have VT-d
-    if (osVer >= 14 && profile.architecture === 'Intel') {
-        // Will be conditionally added if Broadcom card detected
+    const broadcomWifiPolicy = getBroadcomWifiPolicy(profile.wifiChipset, profile.targetOS);
+    if (broadcomWifiPolicy) {
+        for (const kext of broadcomWifiPolicy.autoKexts) {
+            pushUnique(kext);
+        }
     }
 
     const needsAmdCpuSsdt = /\b(a520|b550|a620|b650|x670|x670e|b850|x870|x870e)\b/.test(motherboard);

electron/main.ts

@@ -1761,6 +1761,7 @@ const KEXT_REGISTRY: Record<string, KextRegistryEntry> = {
   'IntelMausi.kext':                    { repo: 'acidanthera/IntelMausi',              assetFilter: 'RELEASE' },
   'RealtekRTL8111.kext':                { repo: 'Mieze/RTL8111_driver_for_OS_X',      assetFilter: 'RealtekRTL8111' },
   'itlwm.kext':                          { repo: 'OpenIntelWireless/itlwm',            assetFilter: 'itlwm' },
+  'AirportBrcmFixup.kext':              { repo: 'acidanthera/AirportBrcmFixup',       assetFilter: 'RELEASE' },
   'USBInjectAll.kext':                  { repo: 'Sniki/OS-X-USB-Inject-All',          assetFilter: 'RELEASE' },
 };
 

electron/wifiPolicy.ts

@@ -0,0 +1,96 @@
+import { parseMacOSVersion } from './hackintoshRules.js';
+
+export type WifiChipsetFamily = 'intel' | 'broadcom' | 'other' | 'unknown';
+
+export type BroadcomWifiSupportClass =
+  | 'native_pre_sonoma'
+  | 'fixup_pre_sonoma'
+  | 'legacy_fixup'
+  | 'legacy_unsupported_on_target'
+  | 'sonoma_root_patch'
+  | 'unknown_broadcom';
+
+export interface BroadcomWifiPolicy {
+  chipset: string;
+  supportClass: BroadcomWifiSupportClass;
+  autoKexts: string[];
+  summary: string;
+}
+
+function normalizeChipset(chipset?: string): string {
+  return (chipset ?? '').trim().toLowerCase();
+}
+
+export function classifyWifiChipsetFamily(chipset?: string): WifiChipsetFamily {
+  const normalized = normalizeChipset(chipset);
+  if (!normalized) return 'unknown';
+  if (normalized.includes('intel')) return 'intel';
+  if (normalized.includes('broadcom')) return 'broadcom';
+  return 'other';
+}
+
+export function getBroadcomWifiPolicy(chipset: string | undefined, targetOS: string): BroadcomWifiPolicy | null {
+  const normalized = normalizeChipset(chipset);
+  if (!normalized.includes('broadcom')) return null;
+
+  const osVer = parseMacOSVersion(targetOS);
+  const policyBase = { chipset: chipset?.trim() || 'Broadcom Wi-Fi' };
+
+  if (normalized.includes('bcm4352') || normalized.includes('bcm43602')) {
+    if (osVer >= 14) {
+      return {
+        ...policyBase,
+        supportClass: 'sonoma_root_patch',
+        autoKexts: [],
+        summary: 'Broadcom BCM4352/BCM43602-class Wi-Fi loses clean native support on Sonoma and newer, so it now needs OCLP/root patches or a card swap.',
+      };
+    }
+    return {
+      ...policyBase,
+      supportClass: 'fixup_pre_sonoma',
+      autoKexts: ['AirportBrcmFixup.kext'],
+      summary: 'Broadcom BCM4352/BCM43602-class Wi-Fi is supported on Ventura and older with AirportBrcmFixup.',
+    };
+  }
+
+  if (normalized.includes('bcm4360')) {
+    if (osVer >= 14) {
+      return {
+        ...policyBase,
+        supportClass: 'sonoma_root_patch',
+        autoKexts: [],
+        summary: 'Broadcom BCM4360-class Wi-Fi loses clean native support on Sonoma and newer, so it now needs OCLP/root patches or a card swap.',
+      };
+    }
+    return {
+      ...policyBase,
+      supportClass: 'native_pre_sonoma',
+      autoKexts: [],
+      summary: 'Broadcom BCM4360-class Wi-Fi is a native-style path on Ventura and older and does not need an injected Wi-Fi kext by default.',
+    };
+  }
+
+  if (normalized.includes('bcm4331') || normalized.includes('bcm43224')) {
+    if (osVer <= 10.15) {
+      return {
+        ...policyBase,
+        supportClass: 'legacy_fixup',
+        autoKexts: ['AirportBrcmFixup.kext'],
+        summary: 'Broadcom BCM4331/BCM43224-class Wi-Fi is a Catalina-and-older legacy path that still needs AirportBrcmFixup.',
+      };
+    }
+    return {
+      ...policyBase,
+      supportClass: 'legacy_unsupported_on_target',
+      autoKexts: [],
+      summary: 'Broadcom BCM4331/BCM43224-class Wi-Fi tops out around Catalina and should not be treated as a normal Big Sur-or-newer path.',
+    };
+  }
+
+  return {
+    ...policyBase,
+    supportClass: 'unknown_broadcom',
+    autoKexts: [],
+    summary: 'Detected a Broadcom Wi-Fi chipset that this generator does not classify cleanly yet. Do not assume a working native wireless path without manual verification.',
+  };
+}

package-lock.json

@@ -1,7 +1,7 @@
 {
   "name": "opcore-oneclick",
   "private": true,
-  "version": "3.2.7",
+  "version": "3.2.8",
   "description": "OpCore-OneClick deployment utility",
   "author": "OpCore-OneClick contributors",
   "main": "dist-electron/electron/main.js",

package.json

@@ -222,6 +222,18 @@ export const KEXT_REGISTRY: KextEntry[] = [
     minOS: '10.13',
     canonicality: 'canonical_with_caveats',
   },
+  {
+    name: 'AirportBrcmFixup',
+    repo: 'acidanthera/AirportBrcmFixup',
+    required: 'conditional',
+    category: 'wifi',
+    description: 'Broadcom Wi-Fi patch set for supported non-native card families.',
+    conditions: ['Broadcom BCM4352/BCM43602 or legacy Broadcom Wi-Fi path'],
+    minOS: '10.10',
+    dependsOn: ['Lilu'],
+    orderingAfter: ['Lilu'],
+    canonicality: 'canonical_with_caveats',
+  },
   {
     name: 'BrcmPatchRAM',
     repo: 'acidanthera/BrcmPatchRAM',

src/data/kextRegistry.ts

@@ -164,6 +164,35 @@ describe('checkCompatibility — warnings', () => {
   });
 });
 
+describe('checkCompatibility — Broadcom Wi-Fi policy', () => {
+  it('marks Sonoma-era Broadcom Wi-Fi as risky instead of pretending it is a clean native path', () => {
+    const report = checkCompatibility(fakeProfile({
+      generation: 'Coffee Lake',
+      isLaptop: true,
+      targetOS: 'macOS Sonoma',
+      wifiChipset: 'Broadcom BCM4352',
+      gpu: 'Intel UHD Graphics 630',
+    }));
+
+    expect(['experimental', 'risky']).toContain(report.level);
+    expect(report.warnings.some((warning) => /broadcom wi-fi/i.test(warning))).toBe(true);
+    expect(report.warnings.some((warning) => /sonoma/i.test(warning))).toBe(true);
+  });
+
+  it('marks legacy Broadcom Wi-Fi as risky on Big Sur and newer', () => {
+    const report = checkCompatibility(fakeProfile({
+      generation: 'Haswell',
+      isLaptop: true,
+      targetOS: 'macOS Big Sur 11',
+      wifiChipset: 'Broadcom BCM4331',
+      gpu: 'Intel HD Graphics 4600',
+    }));
+
+    expect(report.level).toBe('risky');
+    expect(report.warnings.some((warning) => /catalina/i.test(warning))).toBe(true);
+  });
+});
+
 // ─── Next actions ───────────────────────────────────────────────────────────
 
 describe('checkCompatibility — next actions', () => {

test/compatibility.test.ts

@@ -309,6 +309,55 @@ describe('getRequiredResources', () => {
     expect(r.kexts).toContain('VoodooPS2Controller.kext');
   });
 
+  it('adds itlwm only when the detected Wi-Fi chipset is Intel', () => {
+    const intel = getRequiredResources(fakeProfile({
+      isLaptop: true,
+      generation: 'Coffee Lake',
+      wifiChipset: 'Intel Wi-Fi 6 AX200',
+    }));
+    const broadcom = getRequiredResources(fakeProfile({
+      isLaptop: true,
+      generation: 'Coffee Lake',
+      wifiChipset: 'Broadcom BCM4352',
+    }));
+
+    expect(intel.kexts).toContain('itlwm.kext');
+    expect(broadcom.kexts).not.toContain('itlwm.kext');
+  });
+
+  it('adds AirportBrcmFixup for BCM4352-class Broadcom Wi-Fi on Ventura and older', () => {
+    const r = getRequiredResources(fakeProfile({
+      isLaptop: true,
+      generation: 'Haswell',
+      targetOS: 'macOS Ventura',
+      wifiChipset: 'Broadcom BCM4352',
+    }));
+    expect(r.kexts).toContain('AirportBrcmFixup.kext');
+    expect(r.kexts).not.toContain('itlwm.kext');
+  });
+
+  it('does not inject AirportBrcmFixup for BCM4360-class Broadcom Wi-Fi on Ventura and older', () => {
+    const r = getRequiredResources(fakeProfile({
+      isLaptop: true,
+      generation: 'Haswell',
+      targetOS: 'macOS Ventura',
+      wifiChipset: 'Broadcom BCM4360',
+    }));
+    expect(r.kexts).not.toContain('AirportBrcmFixup.kext');
+    expect(r.kexts).not.toContain('itlwm.kext');
+  });
+
+  it('does not treat Sonoma Broadcom Wi-Fi as a normal injected AirportBrcmFixup path', () => {
+    const r = getRequiredResources(fakeProfile({
+      isLaptop: true,
+      generation: 'Haswell',
+      targetOS: 'macOS Sonoma',
+      wifiChipset: 'Broadcom BCM4352',
+    }));
+    expect(r.kexts).not.toContain('AirportBrcmFixup.kext');
+    expect(r.kexts).not.toContain('itlwm.kext');
+  });
+
   it('uses SSDT-AWAC for Coffee Lake desktops', () => {
     const r = getRequiredResources(fakeProfile({
       architecture: 'Intel',