OP mentions https://github.com/firewalld/firewalld/issues/397 and that issue is reportedly fixed with libvirt version 0.5.1 which I assume is a typo and should be 5.1.0. (https://github.com/firewalld/firewalld/issues/397#issuecomment-518264850)
See also https://www.libvirt.org/news.html#v5.1.0 which I found through https://ral-arturo.org/2019/10/14/debian-netfilter.html Seems worth evaluating whether this bug is thereby fixed.
signature.asc
Description: This is a digitally signed message part.
