Discovered during investigation of T6608: current behavior will return the config mode script to run under the CLI context on uncaught error. This occurs for nat64.py due to the following construction:

if __name__ == "__main__":
    try:
        check_kmod(["jool"])
        c = get_config()
        verify(c)
        generate(c)
        apply(c)

The current solution will be to move the modprobe action, and resulting pruning of the config_dict into the verify function: (1) actions which may raise ConfigError (check_kmod) properly belong in verify (or later) stages, so move the required logic out of get_config (2) note that this will be an interesting case for the implementation of commit dry-run, as in the current (and first corrected) implementation, a state query precedes syntax verification.

Symptom of issue on 1.5-rolling-202407282354:

vyos@vyos:/usr/libexec/vyos/tests/smoke/cli$ ./test_nat64.py
test_snat64 (__main__.TestNAT64.test_snat64) ... ok

----------------------------------------------------------------------
Ran 1 test in 4.205s

OK
vyos@vyos:/usr/libexec/vyos/tests/smoke/cli$ journalctl -u vyos-configd --no-pager

Aug 01 15:15:29 vyos vyos-configd[740]: [Errno 253] failed to run command: jool instance display --csv
Aug 01 15:15:29 vyos vyos-configd[740]: returned:
Aug 01 15:15:29 vyos vyos-configd[740]: exit code: 253
Aug 01 15:15:29 vyos vyos-configd[740]: Sending response 4

Response 4 is sent on an error uncaught by the config script, triggering that the script should be re-run within the CLI context, resulting in a passing smoketest but unreported issue. That behavior will be changed in T6608 after any obscured bugs are resolved.