From: Phil Sutter on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2267#note_1253667...
@jtoppins_redhat firewalld does support nft backend, it's the default in RHEL9 IIRC. I guess this is mostly about libvirt migration not being complete.
Maybe moving the modules to kernel-modules-extra could be an option?