DHCP Offer not reaching VM on separate host from DHCP server in cluster

[claremont-awilson]

oVirt cluster (it's oVirt 4.3, OEL7.9) with a DHCP server (dnsmasq) running on a VM attached to ovirtmgmt network (no filter, no security groups).

Create a new VM, attach it to the same ovirtmgmt network, try to PXE boot and it never receives the DHCP Offer from the DHCP server unless it is on the same host as the DHCP server.

DHCP Server --> Host1 --> Host2 --> new VM

Performing a tcpdump on the DHCP Server shows it performing a DHCP Offer, monitoring Host2 (the host of the new VM) shows it receiving the DHCP Offer, but the new VM never receives it.

The 2 hosts do have bonded NICs, but they are active-passive.

Tried different PXE clients (built-in iPXE on NICs, latest iPXE and netboot.xyz).

The NICs are connected to trunk ports, but the default VLAN is that used by ovirtmgmt, so no tagging is configured/needed.

I've atttached the output of iptables, ebtables and firewalld (interface names removed as we name with PII) from the host of the new VM.
ebtables-on-olvm-host.txt
firewalld-on-olvm-host.txt
iptables-on-olvm-host.txt