Try a different FakeSMC? Usually if it really stops at waiting for DSMOS, that's a FakeSMC issue...