I've been following this thread and I decided to make an account because I was able to get my CN-08PKF4 working with @Naidis' fix.
I only did the following steps based on @Hervé's solution:
Inject AirportBrcmFixup, BrcmFirmwareRepoData, and BrcmPatchRAM2 in C/K/O
Add the boot option brcmfx-driver=1 (it would not boot otherwise)
Inject properties (I tried injecting subsystem-id 21 as per another thread but it didn't work )
Taped the 3 pins on the front side and only 2 pins on the bottom just like @Naidis did.
I did not apply FixAirport or AddDTGP. I played a 10 hour loop of a fireplace on youtube to test variations of fixes, and the only one that didn't end up crashing is the method above.
I suggest we figure out why blocking those pins somehow fix the problem.
Changing to brcmfx-driver=2 allows me to do Handoff