Hi, I bought a 2009 A1304 Macbook air with firmware password set, and no OS X installed.
So I get the HDD from the Macbook Air and installed El Capitain 10.11 with a Macbook pro used the HDD as external drive with a special connector. That was a little bit tricky with the ribboncable. After I installed the drive back in the Macbook Air it boots successful. Then I open a Terminal shell and call nvram -c and set a new firmware password with firmwarepasswd and deleted it with the command to ensure it was written to the EFI chip. Now no hardware password is set and I can boot from external devices.
nvram -c
firmwarepasswd -setpasswd (I use 1234)
firmwarepasswd -delete