I used DuetToHdd, than copied Efidlr20 and Efi folder from iboot (chameleon, stolen and rebranded) 1.2 to my usb stick, placed dsdt form edp 1.5 to efi/apci/oem and copied my kext to s/l/e of my Mac OS X Basesystem on my usb stick.
I have BCM4312 and it works in Snow leopard but doesn't work in Lion
I saw to files for broadcom in IO80211Family.kext : AirPortBrcm43xx.kext and AppleAirPortBrcm43224.kext
You need to boot with -v arch=i386 -f otherwise 32-bit wil die during boot
I'll get that most of the time to.
p.s what for broadcom have you, mine doesn't work