FYI to anyone with a Pi 400, stealing the raspi-firmware from sid (raspi-firmware_1.20220331+ds-1 as of this writing) and rebooting results in working wifi on bullseye.
Cherrypicking these three files on their own from upstream rpi-firmware didn't, so still something to be debugged about what needs to change...
- Rich