Skip to content

DEMO (not for merge): LE Data Length Change fix for #514 on macOS Tahoe with AX201 pair issue - #515

Draft
emulatorchen wants to merge 7 commits into
OpenIntelWireless:masterfrom
emulatorchen:feat/le-data-length-injection
Draft

emulatorchen wants to merge 7 commits into
OpenIntelWireless:masterfrom
emulatorchen:feat/le-data-length-injection

Conversation

@emulatorchen

@emulatorchen emulatorchen commented Oct 10, 2026 •

Copy link
Copy Markdown

⚠️ Fix demo — not a merge request

This is a patch for AX201 that won't get pair with keyboard but fine for AirPods and Trackballs that do not need pair code
I think most of people here with AX201 shared the same problem so this is a PR demo for you to build it your own. This patch verified under OC 1.0.7 with Tahoe 26.7.1

Opened only as a reference / demo for anyone hitting #514 (BLE HID devices won't bind on macOS Tahoe). Not intended to be merged here. The direct-upstream PR is lshbluesky#1.

image

Problem

On macOS Tahoe a BLE HID link connects, encrypts and completes PHY, but bluetoothd stalls at LE_READY_WAIT_FOR_LENGTH: the Intel controller never emits an LE Data Length Change event, so GATT never runs and the HID device never binds.

Fix

Resend HCI_OP_LE_READ_REMOTE_FEATURES twice and rewrite the resulting duplicate LE Read Remote Features Complete events in a 3-stage machine:

  1. stage 0 — pass the real event through
  2. stage 1 — rewrite to a fake PHY Update Complete
  3. stage 2 — rewrite to a fake LE Data Length Change (27 octets / 328µs, handle copied from the live event)

This clears the stall and the BLE HID device binds. Verified on an Intel controller with a BLE keyboard on macOS Tahoe.

Note: developed on top of lshbluesky's macOS Tahoe support work, so the diff here includes those commits in addition to the fix itself.

Important

This fix was written by Claude, an AI assistant. It is provided as-is, with no warranty — please review and test it, and use it at your own risk.

lshbluesky and others added 7 commits October 6, 2025 13:27
Patch provided by plooshi.
…AIT_FOR_LENGTH (OpenIntelWireless#514)

On macOS Tahoe a BLE HID link connects, encrypts and completes PHY, but
bluetoothd stalls at LE_READY_WAIT_FOR_LENGTH: the Intel controller never
emits an LE Data Length Change event, so GATT never runs and no HID binding
happens.

Resend HCI_OP_LE_READ_REMOTE_FEATURES twice and rewrite the resulting
duplicate LE Read Remote Features Complete events in a 3-stage machine:
stage 0 passes the real event through, stage 1 rewrites to a fake PHY Update
Complete, stage 2 rewrites to a fake LE Data Length Change (27 octets / 328us,
handle copied from the live event). This clears the stall and HID binds.

Also bump MODULE_VERSION to 2.5.2.
@emulatorchen
emulatorchen force-pushed the feat/le-data-length-injection branch from 2894979 to c39d957 Compare October 10, 2026 05:36
@emulatorchen emulatorchen changed the title fix(IntelBTPatcher): inject LE Data Length Change to clear LE_READY_WAIT_FOR_LENGTH (#514) [for reference] DEMO (not for merge): LE Data Length Change fix for #514 on macOS Tahoe Oct 10, 2026
@emulatorchen
emulatorchen marked this pull request as draft October 10, 2026 05:37
@emulatorchen emulatorchen changed the title DEMO (not for merge): LE Data Length Change fix for #514 on macOS Tahoe DEMO (not for merge): LE Data Length Change fix for #514 on macOS Tahoe with AX201 pair issue Oct 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants