The validation introduced for T5833 — “Not all AFIs are compatible with VRF” (https://vyos.dev/T5833), implemented in PR #3359 (https://github.com/vyos/vyos-1x/pull/3359), is bypassed in the tested rolling revision (e559637d34e0). Unsupported AFI/SAFI combinations on neighbors and peer groups in named VRFs pass VyOS validation. A local commit test using ipv4-vpn reached FRR and failed with Only Unicast/Multicast/EVPN SAFIs supported in non-core instances.

In src/conf_mode/protocols_bgp.py, the guard in verify() checks 'vrf' in bgp. However, the VRF name is supplied through config_dict['vrf_context'] and already assigned to the local variable vrf; the BGP dictionary does not contain a vrf key at this stage.

The fix is a one-line change that uses the existing VRF context:

• if 'vrf' in bgp and 'address_family' in peer_config:

+ if vrf and 'address_family' in peer_config:

This restores the existing T5833 restrictions for IPv4/IPv6 FlowSpec, labeled-unicast, and VPN address families. Invalid configurations are rejected before FRR application with a clear error such as VRF is not allowed for address-family 'ipv4-vpn'.

Regression tests in src/tests/test_bgp_vrf_afi.py cover all six restricted combinations for both neighbors and peer groups, and verify that supported families in named VRFs and the same six families in the default VRF continue to pass validation. Local before/after commit testing confirmed the corrected behavior for ipv4-vpn.