The zone template dereferences from_conf.firewall[fw_name] on entries that have no firewall key, rendering a jump with no target.

Location
data/templates/firewall/nftables-zone.j2:103

src/conf_mode/firewall.py:176

compare data/templates/firewall/nftables-zone.j2:85
Problem
default_local entries are bare {'name': ...}; .firewall is undefined and ChainableUndefined renders ''.

Impact
Local zone + VRF-member zone with default-firewall fails commit with an nft syntax error.

Suggested fix
Use from_conf[fw_name]; smoketest for the combination.