I was wondering why I couldn't get DSCP marked packets to match, just to discover that the code to make the rules are actually incorrect. OP gave the exact code - which I wish had noticed earlier - to make it work as intended. I can confirm it does work with both ipv4 and ipv6, with and without ECN bit set. So maybe you can use that code to update vyos/qos/base.py, which I currently run without problems: