Tested https://github.com/vyos/vyos-build/pull/1040. Now it works as expected.

Resolve issues with initial PRs.

Added https://github.com/vyos/vyos-1x/pull/4739

FRR PR: https://github.com/FRRouting/frr/pull/19593
VyOS PR with patch: https://github.com/vyos/vyos-build/pull/1040

Additional PR for tpmtest:
https://github.com/vyos/vyos-build/pull/1039

PRs:
https://github.com/vyos/live-boot/pull/8
https://github.com/vyos/vyos-1x/pull/4732

Sorry, please consult about dates of releases with support.

When is 1.4.4 planned for release?

https://github.com/vyos/vyos-build/pull/1033
https://github.com/vyos/vyos-1x/pull/4723

Yes, it will be fixed in release 1.4.4.

Ergo: Upgrading to 1.4.4 fixes this?

It is fixed.

@hedrok could you re-check and mark as solved if all work as expected?

Any updates on this? We're running 1.4 and this is holding back required changes in our configuration.

The issue is still reproducible in FRR's master.
I've prepared my own fix in FRR: https://github.com/FRRouting/frr/pull/19564
As patch in VyOS: https://github.com/vyos/vyos-build/pull/1029

I've created: https://github.com/vyos/vyos-1x/pull/4720

https://github.com/vyos/vyos-1x/pull/4714

Fix:
https://github.com/vyos/vyos-build/pull/1026 - cherry-pick of FRR commit that adds 'table-direct' support for OSPF.
https://github.com/vyos/vyos-1x/pull/4704 - replaces table with table-direct in FRR config for command set protocols ospf redistribute table 10.

With nightly 2025.09.01-0023-rolling it is working (maybe the last kernel bump fixed it ?) :

PR: https://github.com/vyos/vyos-1x/pull/4698

https://github.com/vyos/vyos-1x/pull/4695

https://github.com/vyos/vyos-documentation/pull/1678

I found a companion issue to this and created a task for it:
https://vyos.dev/T7781

In T7761#234119, @Fabse wrote:

aggregation — ipt-netflow allows rewriting IP prefixes and ports. Do we want that?

This feature is crucial for our use case. We are using a custom build for ipt_NETFLOW since 2024 in order to --enable-aggregation for being able to account all flows (sampling rate 1) while keeping flow cardinality manageable. --enable-direction would be great as well.

PR https://github.com/vyos/vyos-1x/pull/4688

PR https://github.com/vyos/vyos-1x/pull/4688

aggregation — ipt-netflow allows rewriting IP prefixes and ports. Do we want that?

I suggest just removing buffer-size option - in data/templates/pmacct/uacctd.conf.j2 it is translated to pmacct option plugin_pipe_size - specific to pmacct option about pipe size between processes of pmacct.
ipt_NETFLOW's sndbuf is size of output socket buffer in bytes with system default as default - no relation to plugin_pipe_size pmacct option, I don't think there is need to publish it via vyos CLI.

I think the entire idea was missguided and misslead by the fact that tokens are not supported on every interface type - only interfaces supporting "ARP" in the iproute2/Kernel source code but thats wrong in a different story.

Will be fixed after migration to the accel-ppp-ng T7744

Correction to the steps required to support ALL kea options programatically- it may need to be more like this:

As a note for myself and any other users not familiar with the project who need to perform a task like this in the feature, a few notes on changes needed based on a quick survey:

In T7723#232731, @Viacheslav wrote:

You need to add changes only in the vyos-1x repo

You need to add changes only in the vyos-1x repo

I would like to send a PR for this if I have time as it seems like a relatively good first issue to work on.

Pardon my typo in the notes, the correct option number is 26 as in the title of the issue

To clarify, I’m only asking that this option can be set to an integer. It would be neat to be able to instruct it to set the option to a value dynamically, deriving it from a specified interface, but that’s a lot more effort and probably rarely worth it

Let's check if nftables improved that. Either we can do it easily now, or we'll close this as wontfix, if Linux just doesn't implement feasible RPF as per the RFC.

the ticket is closed, and

ssh vyos@vyos -- /opt/vyatta/bin/vyatta-op-cmd-wrapper show interfaces

Also I realized, that the insert_failed and drop counters of conntrack are increasing:

I forgot to mention, that deleting the vrf_zones table "fixes" the issue.