Direct HCI VS calls to PAN1323 fail...

I am using MSP-EXP430F5438 host[s] and PAN1323ETU controller[s] as an initial development system for a series of products that will work together in a piconet. The piconet will provide proprietary functionality. This is an embedded application in which none of the hosts implement an operating system. Instead, each is using a non-preemptive task manager to initiate and manage BT connections via the HCI.

At this time there is no problem using the out-of-the-box PAN1323 controller (i.e. without loading a service pack) to implement a range of HCI commands. However, the PAN1323's cannot be made discoverable in their default mode and so I am working on loading the latest flavor of service pack.
       Note: the HCI can now be used to carry out Inquiries and do other things,such as Remote_Name_Requests. The UART connection between Host and Controller
is functioning well. The radios appear to be working. The controller is responsive.

The service packs (as far as I know) depend upon HCI Vendor-Specific commands to carry out various actions. The use of HCI VS commands has been discussed elsewhere on this forum (one example discussed was the rewriting of the controller BD_ADDR). The service pack data appears as an array of properly formatted HCI VS command packets which can be transmitted to the Controller as-is (albeit with Event arbitration for packets).

My immediate problem is that any HCI VS command that is issued during BT initialization generates a Command_Complete_Event containing an invalid OpCode and an Unknown HCI Command error code (the actual Event packet for any command is: 04 0E 04 01 01 01 01).

A Hardware Reset (nSHUT_DOWN set low for > 5ms) is done for the PAN1323 and the Controller CTS is monitored before attempting to write any service pack data.

Attempts to send individual VS HCI command packets also fail, although commands such as HCI_VS_Get_System_Status and HCI_VS_Read_Patch_Version fail without generating any event response to the Host. After sending these commands the PAN1323 must be reset before it will respond to subsequent commands.

So...

1] Can the PAN1323 (and its siblings) be operated without using any vendor-supplied code above the HCI... can a full application be created using only proprietary code to drive the HCI? (this would be compliant with the BT specification)

2] Can the HCI VS commands be issued directly?
   i.e. is it necessary to use some proprietary method to somehow "unlock" the controller or implement an HCI VS lock/unlock sequence, such as by using the HCI_VS_Start/Stop_VS_Lock sequence...which require knowing the appropriate software version information? This doesn't appear to be a Start/Stop_VS_Lock problem since a "brute force" test was used to test all possible version values and...it failed.

3] If [1] is possible, then what must be done to unlock the full potential of the PAN1323, allowing the device to be discoverable and connect with other controllers?

4] What questions should I be asking?

Thanks.