2019-07-04 08:31:27.164066+0800 localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::loadFirmwareFile(char const*, char const*)> BrcmPatchRAM: Loaded firmware "BCM4350C5_003.006.007.0095.1703_v5799.hex" from resources.
2019-07-04 08:31:27.164071+0800 localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::loadFirmware(unsigned short, unsigned short, OSString*)> BrcmPatchRAM: Non-compressed firmware.
2019-07-04 08:31:27.164169+0800 localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::loadFirmware(unsigned short, unsigned short, OSString*)> BrcmPatchRAM: Firmware is valid IntelHex firmware.
2019-07-04 08:31:27.164191+0800 localhost kernel[0]: (kernel) BrcmPatchRAM2: uploadFirmware could not open the device!
2019-07-04 08:31:27.165286+0800 localhost kernel[0]: (kernel) BrcmPatchRAM2: [0a5c:6412]: Found existing IOKit personality "com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport".
2019-07-04 08:31:27.165292+0800 localhost kernel[0]: (kernel) BrcmPatchRAM2: Processing time 0.158 seconds.
2019-07-04 08:31:27.166837+0800 localhost kernel[0]: (kernel) BrcmPatchRAM2: Version 2.2.10 starting on OS X Darwin 18.7.
2019-07-04 08:31:27.166868+0800 localhost kernel[0]: (kernel) BrcmPatchRAM2: uploadFirmware could not open the device!
2019-07-04 08:31:27.168196+0800 localhost kernel[0]: (kernel) BrcmPatchRAM2: [0a5c:6412]: Found existing IOKit personality "com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport".
2019-07-04 08:31:27.168208+0800 localhost kernel[0]: (kernel) BrcmPatchRAM2: Processing time 0.1 seconds.
I used the hex firmware but still didn't succeed and got the log above.
BrcmPatchRAM2.kext.zip BrcmBluetoothInjector.kext.zip BrcmFirmwareRepo.kext.zip