BlueToolFixup: Add Fast-Connect A2DP patch to fix "Connected but No Sound" issue for third-party controllers on Apple Headphones

[hexxyan]

Summary

This PR adds an opt-in runtime patch for bluetoothd that resolves the infamous "Connected but No Sound" issue when using third-party Bluetooth controllers (e.g. Intel) with modern Apple headphones equipped with W1/H1/H2 chips (AirPods Pro 2, AirPods Pro 3, etc.).

Related issue: OpenIntelWireless/IntelBluetoothFirmware#462

Problem

Apple's bluetoothd relies on HCI_Read_Clock during the A2DP Fast-Connect reconnection path. Third-party controllers that do not implement or fail to respond to this HCI command in time cause bluetoothd to abort the audio pipeline setup, resulting in a successful Bluetooth connection with zero audio output. The system log shows:

Failed to read BT clock

Solution

The patch identifies the conditional branch (test + je) that gates the A2DP audio bring-up path based on the HCI_Read_Clock result, and replaces it with an unconditional jump (xor + jmp) to force the success path.

Two pattern families are defined to cover all supported macOS versions:

Pattern	macOS Versions	Register	Signature Head
14_0	14 (Sonoma), 15 (Sequoia), 26 (Tahoe)	%r14d	45 85 F6 74 25
12_0	12 (Monterey), 13 (Ventura)	%ebx	85 DB 74 25

Both patterns were verified by extracting bluetoothd binaries from official Apple Recovery images and performing byte-by-byte comparison.

Usage

The patch is opt-in and activated by the following boot argument:

-btlfxa2dpcheck

No existing behavior is changed unless this boot-arg is explicitly set.

Testing

Item	Detail
macOS Version	macOS 26.4 Tahoe
Bluetooth Adapter	Intel AX201 160MHz (Wi-Fi 6)
PCI ID	8086:06f0:8086:0074 (Comet Lake PCH CNVi WiFi)
Test Device	AirPods Pro 2 (H2 chip)
Result	✅ A2DP audio stream established successfully. No more "Failed to read BT clock" abort.

Note: macOS 12–15 patterns are derived from binary analysis of official Apple Recovery images and are theoretically correct, but have not yet been tested on physical hardware running those versions. Community testing and feedback is welcome.

Changes

• BrcmPatchRAM/BlueToolFixup.cpp: Added kFastConnectA2DPGate* pattern arrays, version-aware patching logic (>= Sonoma / >= Monterey), and the -btlfxa2dpcheck boot-arg check.

Documentation

A detailed technical write-up of the reverse-engineering process, including the automation scripts (find_gate.py, verify_gates.py) used to locate and validate the patch signatures, is available at:
🔗 BlueToolFixup-A2DP-Documentation

[Ardaninho]

Tested with the fork's release, thoroughly checked, works beautifully. Doesn't give me that headache.
Tested on 26.4, Intel AX200 and AirPods Pro 3.

[hexxyan]

Tested with the fork's release, thoroughly checked, works beautifully. Doesn't give me that headache.
Tested on 26.4, Intel AX200 and AirPods Pro 3.

Thanks for testing! Glad it helps!

[sambow23]

This is working for me with AirPods Pro 2 and AC 9260 on macOS 15.7.5

[Andynet911]

13.7.8 (22H730) AirPods Pro 2 AX200 有效

[hexxyan]

13.7.8 (22H730) AirPods Pro 2 AX200 有效

Cheers!

[istvanmate]

26.4.1, Dell Precision 3640 (AX201) rarely had sound with AirPods Pro 2, with this patch always has.
26.4.1, Dell Precision 5550 (AX201) rarely had no sound with AirPods Pro 2, with this patch always has.
Great job!

[ou8zz]

15.3.1 (24D70) AirPods Pro 2 AX201 测试有效，终于正常了。之前一直在排查USB定制和OCLP，花了不少时间。直到GPT提到了有不少人遇到这个问题。舒服了。