Intel AC 9260 BT firmware upload timeout on C422 HEDT platform (macOS Sonoma 14.x)

[likk666]

Have you read the docs?

Yes

macOS Version

macOS 14.X

Kext Version

IntelBluetoothFirmware: 2.5.0 (Dortania CI build: commit 01cc180) IntelBTPatcher: 2.5.0 (same build) BlueToolFixup: 2.7.2

Wireless Adapter Model and USB Product ID

Intel Wireless-AC 9260 (ThunderPeak) Vendor ID: 0x8087, Product ID: 0x0025

Description

Environment

Item	Details
Hardware	HP Z4 G4 Workstation
CPU	Intel Xeon W-2135 (Skylake-W, Basin Falls HEDT)
Chipset	Intel C422 (Lewisburg PCH)
USB Controller	Lewisburg PCH XHCI (8086:A2AF)
Wireless Card	Intel Wireless-AC 9260 (M.2 2230, PCIe+USB BT)
BT USB VID/PID	0x8087 / 0x0025 (bootloader mode)
SMBIOS	MacPro7,1
macOS	Sonoma 14.x
OpenCore	1.x
IntelBluetoothFirmware	2.5.0 (Dortania CI build: IntelBluetoothFirmware-01cc180)
IntelBTPatcher	2.5.0
BlueToolFixup	2.7.2

NVRAM Config

• bluetoothExternalDongleFailed: 00 (DATA) — in both Add and Delete sections
• bluetoothInternalControllerInfo: 00000000 00000000 00000000 0000 (DATA) — in both Add and Delete sections
• boot-args include: -btlfxallowanyaddr -btlfxboardid

Symptom

Bluetooth panel always shows:
Address: NULL State: Off Chipset: BCM_4350C2 Vendor ID: 0x004C (Apple) Firmware Version: v0 c0

Confirmed Working on Linux

On Linux (Ubuntu Live), the exact same hardware works perfectly:
$ lsusb | grep 8087 Bus 001 Device 006: ID 8087:0025 Intel Corp. Wireless-AC 9260 Bluetooth Adapter

$ hciconfig -a hci0: Type: Primary Bus: USB BD Address: 34:13:E8:9E:B1:C2 UP RUNNING HCI Version: 5.1 (0xa) Manufacturer: Intel Corp. (2)

Hardware is confirmed functional. Firmware loads successfully on Linux.

Info in System Report - Bluetooth

## Diagnostics on macOS
**kextstat confirms all kexts are loaded:**
63 0 com.zxystd.IntelBTPatcher (2.5.0) 62 0 as.acidanthera.BlueToolFixup (2.7.2) 114 0 com.zxystd.IntelBluetoothFirmware (2.5.0)

**ioreg confirms IntelBluetoothFirmware IS matched to the device:**
"idProduct" = 37 ← 0x0025 "idVendor" = 32903 ← 0x8087 "CFBundleIdentifier" = "com.zxystd.IntelBluetoothFirmware" "IOClass" = "IntelBluetoothFirmware"

**USB device is visible and marked Built-In:**
$ system_profiler SPUSBDataType | grep -A10 "Bluetooth USB Host Controller" Product ID: 0x0025 Vendor ID: 0x8087 (Intel Corporation) Location ID: 0x14a00000 / 6 Built-In: Yes

Relevant log output

## Kernel Log — Exact Failure Sequence
17:48:56.312 HS12@14a00000: enumerated 0x8087/0025/0002 at 12 Mbps 17:48:56.313 AppleUSBLegacyRoot: registering IOUSBHostDevice@14a00000 for matching 17:48:56.314 IOUSBHostDevice@14a00000: IntelBluetoothFirmware selected configuration 1 17:48:56.465 HS12@14a00000: terminateDevice: destroying 0x8087/0025/0002: hardware connection lost ↑ Device soft-resets — this appears to be NORMAL Intel BT behavior ↑ (entering firmware download mode) 17:48:56.687 HS12@14a00000: enumerated 0x8087/0025/0002 at 12 Mbps ← re-enumerated 17:48:56.688 AppleUSBLegacyRoot: registering IOUSBHostDevice@14a00000 for matching 17:48:56.688 IOUSBHostDevice@14a00000: IntelBluetoothFirmware selected configuration 1 ↑ Second attempt at firmware download 17:49:05.903 AppleUSBIORequest::complete: device 6 (Bluetooth USB Host Controller@14a00000) endpoint 0x00: status 0xe00002d6 (timeout): 0 bytes transferred ↑ USB control pipe timeout — 0 bytes, ~9 second wait

**Key observations:**
1. The device undergoes a normal soft-reset after first config selection (expected Intel BT behavior)
2. After re-enumeration, IntelBluetoothFirmware selects configuration again
3. The USB control endpoint (0x00) times out with **0 bytes transferred** after ~9 seconds
4. PID stays at 0x0025 throughout — firmware never reaches the chip
5. `log show --predicate 'sender CONTAINS "IntelBluetooth"'` returns **zero log entries** from IntelBluetoothFirmware itself

Kernel Panic Logs

## Platform-Specific Notes
- USB controller: **Lewisburg PCH XHCI** (8086:A2AF), requires `XHCI-unsupported.kext`
- BT USB path: M.2 slot → internal USB2 header → PCH XHCI port **HS12** (location 0x14a00000)
- Device is behind an `AppleUSB20InternalHub` in the USB tree
- `AppleUSBLegacyRoot::usbServiceCallback` is triggered on each enumeration event (likely due to XHCI-unsupported.kext activating legacy USB compatibility layer)
## Question
Is the firmware download protocol for **ThunderPeak (AC 9260, PID 0x0025)** sensitive to USB control pipe timing after the device's bootloader soft-reset?
The 9-second timeout with 0 bytes suggests the device is not responding to any USB control transfers in the window after re-enumeration. This may be a timing issue specific to the Lewisburg PCH XHCI controller's legacy compatibility mode.
Any guidance on debugging this further (e.g., enabling verbose firmware load logging) would be appreciated.