Add MCHOSE A7 V2 driver and MagDock lighting

[jamezrin]

Adds support for the MCHOSE A7 V2 family and for the MCHOSE MagDock charging base, both reverse-engineered from scratch and verified end-to-end against an A7 V2 Ultra+ over its 2.4 GHz receiver and over its cable.

The protocol

Two unrelated protocols live under the same vendor ID (0x3837), so they get two codecs and two drivers:

Mouse — feature reports 0x11 (20 bytes) and 0x12 (64 bytes) on usage page 0xff01. Every byte of the command body is bit-inverted (XOR 0xFF) on the wire; the encoder inverts on the way out and the decoder un-inverts behind the report-ID byte. This is why earlier 0xff01 traffic looks like garbage or like a "loopback" — it isn't, the inversion is the framing.

MagDock — plain, non-inverted frames on an unnumbered output report (report 0), usage page 0xff00, shaped [0xaa][cmd][cmdType][seq][total][paramLen][params…]. Only lighting is exposed.

docs/mchose-protocol.md is the full write-up: report layout, the config block field by field, the button vocabulary, and the dead ends (including a whole 0x4D-magic codec built on a wrong guess and thrown away) so nobody re-walks them.

What the mouse driver supports

Read and write, each round-tripped on hardware and restored to its entry value:

• DPI — current value, per-stage values, active stage, stage count
• polling rate, with the wired and wireless halves of the config kept independent
• lift-off distance, motion sync, angle snapping, ripple control
• the three-way power mode (Performance / eSports / Ultra, bits 6–7 of the sensor byte)
• angle tuning, a signed −30…+30 stored two's-complement at config offset 49
• debounce time and sleep timeout
• onboard profile switching, with the device-stored profile names
• button remapping across the full vendor vocabulary (mouse, keyboard, media, DPI, system, profile, disable)

Notes on the implementation

• Reply plausibility. The firmware serves stale replies out of a shared buffer, so a read can hand you a battery payload where a config block should be. request() requires both a command echo and a caller-supplied accept() check before it trusts a frame. A regression test covers exactly this (it is named after the write that nearly went out with a battery payload in it).
• Settle timings are per-command constants rather than one global delay; the performance write in particular needs several attempts before it sticks.
• LOD mask is 0x03, not 0x07. Bit 2 of that byte is ripple control — masking three bits made LOD read as level 4 and disappear from the UI whenever ripple was on. There is a test decoding 0x84 for it.
• The mouse driver explicitly excludes the dock's PID so the two drivers never both claim a device; the registry probe matrix enforces it.

The A7 V2 Ultra+ is verified hardware. The other A7 V2 variants share the protocol and are marked likely — they have not been tested.

🤖 Generated with Claude Code