I tried binary patch airportbrcm4360 kext and got kp. I think it might be useful to share this result since it help us track where the problem is.
The function I am working is wlcStart(). The patch is to find 0f842f010000 with 0f852f010000 because it will jump to error calling function without this patch. The address for the code is 0x171fb. I'm pretty sure that macos does hit this line.