Nevermind, looks like a misunderstanding on my part. Sorry for the noise.

Some disappointing news though, after more testing on a non-vyos box, I was not able to get offload to work. Adding the representor device to the flowtable with HW offload flag works, but flows routed through the child netdev don't get the HW_OFFLOAD flag in conntrack -L, so they're not being offloaded.

@kakurpiel is correct, TC flowtable does not work with Intel cards due to lack of driver support. I suggest this ticket can be closed.

I guess fixing this would require a rework of the nftables ruleset to use a single table inet vyos_filter for both v4 and v6. Probably a big change - though personally I think it would also be a huge useability win to not have to have two copies of every ACL. It would shorten my config a lot, and prevent screwups due to not keeping the v4 and v6 ACLs in sync.