The networkUpdate() method in libvirt source will recreate firewall
rules if any DHCP hosts change. This is because the firewall rules
differ when there is zero vs non-zero number of DHCP hosts present.
This could be optimized to only recreate when going from zero to
non-zero or vica-verca.
Thanks for the information, Daniel. I have created
https://gitlab.com/libvirt/libvirt/-/issues/76 to track this as a
libvirt issue.
Best regards,
Joel