And there was much rejoicing! I didn't quite do it the "right" way, but I got my ports working for now so that I can at least map the working ones before trying to figure out the non-working ones, if I need them.
First I removed USBMap.kext, reinstalled USBInjectAll.kext, re-loaded OC Snapshot to fix the kexts, and re-enabled XhciPortLimit. After re-start USB still didn't work, probably because I need the (temporary) fix to enable more than 15 ports. Without this fix I can't test each port with a USB device, but I figured I might be able to cheat a bit just to get the keyboard working for now:
Now that I understand more how HS01 and SS01 relate to each other, I went back to the port map. Hackintool and USBMap give the same data, but USBMap is easier to copy so I'll show it here:
Code:
----- XHC@14 Controller -----
1. HS01 | AppleUSB20XHCIPort | 01000000 | 14100000
2. HS02 | AppleUSB20XHCIPort | 02000000 | 14200000
3. HS03 | AppleUSB20XHCIPort | 03000000 | 14300000
4. HS04 | AppleUSB20XHCIPort | 04000000 | 14400000
5. HS05 | AppleUSB20XHCIPort | 05000000 | 14500000
6. HS06 | AppleUSB20XHCIPort | 06000000 | 14600000
7. HS07 | AppleUSB20XHCIPort | 07000000 | 14700000
8. HS08 | AppleUSB20XHCIPort | 08000000 | 14800000
9. HS09 | AppleUSB20XHCIPort | 09000000 | 14900000
10. HS10 | AppleUSB20XHCIPort | 0a000000 | 14a00000
11. HS11 | AppleUSB20XHCIPort | 0b000000 | 14b00000
12. HS12 | AppleUSB20XHCIPort | 0c000000 | 14c00000
13. HS13 | AppleUSB20XHCIPort | 0d000000 | 14d00000
14. HS14 | AppleUSB20XHCIPort | 0e000000 | 14e00000
15. SS01 | AppleUSB30XHCIPort | 10000000 | 14f00000
16. SS02 | AppleUSB30XHCIPort | 11000000 | 14000000
17. SS03 | AppleUSB30XHCIPort | 12000000 | 14100000
18. SS04 | AppleUSB30XHCIPort | 13000000 | 14200000
19. SS05 | AppleUSB30XHCIPort | 14000000 | 14300000
20. SS06 | AppleUSB30XHCIPort | 15000000 | 14400000
----- EH02@1A Controller -----
21. PRT1 | AppleUSBEHCIPort | 01000000 | 1a100000
22. PRT2 | AppleUSBEHCIPort | 02000000 | 1a200000
----- EH01@1D Controller -----
23. PRT1 | AppleUSBEHCIPort | 01000000 | 1d100000
24. PRT2 | AppleUSBEHCIPort | 02000000 | 1d200000
It's my understanding that the 15-port limit is per controller. I know my front USB ports are both 3, and I think I'm currently using only the USB 3 on the rear, so I enabled all of EH01/02 (<15 each) and then enabled 1-6 and 15-20 on XHC controller.
After creating a kext from those selected ports, I deleted USBInjectAll.kext, copied over the map kext, re-loaded OC Snapshot, disabled XhciPortLimit.
I rebooted and now my keyboard, scanner and both front ports (one of which has mouse's BT dongle) work again! Since those are the only ports I've needed in 6 years of using the computer, I'll probably be ok. Probably.
I realize this isn't the ideal way to do it, but I wanted to use the computer today without remoting in from my windows computer with TeamViewer. I think the best way would have been to apply the patch to change the port limit to 20, figure out exactly which ports I need, and then select up to 15 of the XHC ports. If I find myself needing to plug more USB devices, I'll probably dig back into this to enable more of the USB2 ports that are currently not mapped.