I'm working on a virtual HID device driver that derives from IOHIDDevice, but at the moment it's a bit crashy due to L2CAP packets failing somewhat randomly. Here is a userland app that pairs with the device properly. You can look at the normal interrupt packets from the Wii Remote using Apple's Bluetooth PacketLogger.
RVL Enabler (Just press Search in the Device Discovery window and it will find and pair any Wii Remotes that are discoverable)
The secret sauce here is:
if ([wiiDevice openL2CAPChannelSync:&cchan withPSM:17 delegate:self] == kIOReturnSuccess)
printf("Control Channel opened.\n");
if ([wiiDevice openL2CAPChannelSync:&ichan withPSM:19 delegate:self] == kIOReturnSuccess)
printf("Interrupt Channel opened\n");
Then you can write with [cchan writeSync:buffer:length]
To read, implement - (void)l2capChannelData
void *)dataPointer length
Basically, I'm implementing Bluetooth HID myself on top of the L2CAP stack.