The AirPortBrcm4331.kext is a plugin for the bundled IO80211Family.kext. It is has a linked dependancy on this kext and that may be where the problem lies. I would suggest copying into the plugins of the Catalina IO80211Family.kext and then carry out the permissions etc. I think this is what the dosdude1 patch does and obviously the legacy wifi can work once patched as proven by the Catalina Patcher thread. As you have found, trying to run AirPortBrcm4331.kext directly from L/E or with OC has not worked. If you successfully patch then you will likely have to repeat this during an update as there may be a fair chance that the patch is overwritten.
If the patched Catalina IO80211Family.kext does bring back your wifi then it would be interesting to see whether OC could insert this kext and therefore solve the problem of the fix being overwritten in future. Good luck
[automerge]1592130963[/automerge]
@cdf. If you have time can you explain why the AppleMCEReporterDisabler.kext (page 1) does not have an Executable path set. I have looked in the manual and it does not really help me in understanding when the Executable path has to be set or not. Failsafe being empty.