I've gotten macOS 10.12 booted successfully on my machine (desktop) for awhile now
Createinstallmedia is what I first tried and unfortunately I wasn't able to successfully inject any kexts
(Therefore FakeSMC wasn't capable of loading)
The kernel disallowed the driver object from loading as it got injected
In log you would see "not entitled to link kext KEXT_IDENTIFIER"
And if I continued the boot I got stuck at where y'all are getting stuck at (iCloud/FindMyDevice messages)
This is what I did to get the installer booted:
1. Restore BaseSystem.dmg to a partition
2. Remove the Packages symlink from /System/Installation
3. Copy the real Packages folder over
4. Copy BaseSystem.dmg and BaseSystem.chunklist to root of partition (not sure this is necessary, but just to make sure I did it)
5. Copy any kexts needed such as FakeSMC to the root of the FS
6. Boot the installer in single user
7. Disable SIP for the time being via "csrutil disable" or "csrutil enable --without kext"
9. Boot the installer into single user again
10. Modify the permissions on the kext (chmod -R 755 KEXT_NAME.kext && chown -R root:wheel KEXT_NAME.kext)
11. Load the kext manually (kextload KEXT_NAME.kext)
12. Exit single user
NOTE: I didn't use a USB to install, I created an installer partition on one of my main drives
And for me, I was able to get to the installer using that method. I think you can try putting the kexts into SLE of the installer after disabling SIP and that should work too, but just to make sure they loaded, I did that.
After installation I copied the kexts over to the installation volume and I was able to boot fine.
Can you please post a IOREG? Thanks!