The NAT64 "only one netfilter instance" check reads a mode node that does not exist, so it never fires.

Location

src/conf_mode/nat64.py:82, :105, :172

interface-definitions/nat64.xml.in

Problem
i.get('mode') == 'netfilter' and is_node_changed([..., 'instance-N', 'mode']) reference keys that do not exist; generate() hard-codes framework: netfilter.

Impact
A second rule passes verify and fails inside apply after the first instance is created.

Suggested fix
Count all non-deleted rules (framework is always netfilter) and raise in verify.