Lian Li wireless PC fans use a proprietary 2.4 GHz network: WCH RF_PHY basic mode, 2 Mbps, access address 0x71764129, custom CRC-24 init 0xA0F955.

I got an ESP32-C3 to speak it using ESPeranto (hooks the BLE controller ROM to use a custom sync word):

• RX: custom access address via ESPeranto, dewhitening in software.
• TX: the DTM hardware won't whiten or add a valid custom CRC, so each frame goes out as a packet-in-packet: CRC-24 + whitening computed in software, and the real frame embedded inside the DTM payload behind a 0x55 preamble.
• PC side: a Rust app emulates the original USB dongle over USB/IP, so the vendor software (L-Connect 3) drives the C3 without knowing.

Known limitation: the C3 BLE controller leaks a buffer per TX in this mode and asserts after a few hundred TX; the host recovers it with an RTS reset.

Code (ESP-IDF 4.4, MIT): https://github.com/erycson/lianli-wireless-controller