No DHCP Reply em bridge com interface QEMU e TAP

Question

Eu tenho uma máquina host executando uma máquina virtual com o QEMU e quero que o servidor DHCP no host forneça um endereço IP para ela.

Estou usando endereços de ethernet estáticos para os convidados, então eu os inicio assim:

qemu-system-x86_64 -hda debian.img -netdev tap,id=n1,ifname=tap0001,script=/root/qemu/net-up.sh,downscript=/root/qemu/net-down.sh -device virtio-net-pci,netdev=n1,mac=02:00:00:01:01:01 -enable-kvm -cdrom /root/qemu/install-amd64-minimal-20180802T214502Z.iso -boot d -enable-kvm -qmp tcp:localhost:4444,server,nowait -smp 2,cores=16,threads=1,sockets=2,maxcpus=32 -m size=1G -vnc :1

Como desejo gerenciar as reservas de host por meio de um banco de dados, estou usando o servidor DHCP Kea com o MySQL Backend.

Depois de iniciar a VM, tenho a seguinte configuração de rede:

Host:
eno1: 10.0.0.1 (listening for dhcp requests)
tap0001: no IP (TAP interface for the VM)
br00001: no IP (bridges tap0001 and eno1)

Guest:
eth0: hw ether 02:00:00:01:01:01

Agora, quando eu solicito um IP do host, posso ver o Kea oferecendo o IP configurado:

2018-08-15 23:13:46.536 INFO  [kea-dhcp4.leases/6548] DHCP4_LEASE_ADVERT [hwtype=1 02:00:00:01:01:01], cid=[ff:00:01:01:01:00:01:00:01:23:07:53:2b:02:00:00:01:01:01], tid=0xf069f396: lease 10.0.0.10 will be advertised
2018-08-15 23:14:51.444 INFO  [kea-dhcp4.leases/6548] DHCP4_LEASE_ADVERT [hwtype=1 02:00:00:01:01:01], cid=[ff:00:01:01:01:00:01:00:01:23:07:53:2b:02:00:00:01:01:01], tid=0xf069f396: lease 10.0.0.10 will be advertised

Eu também posso ver o DHCP descobrir e responder em eno1:

tcpdump port 67 or port 68 -i eno1 -nN
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eno1, link-type EN10MB (Ethernet), capture size 262144 bytes
23:11:41.326945 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 02:00:00:01:01:01, length 356
23:11:41.329444 IP 10.0.0.1.67 > 10.0.0.10.68: BOOTP/DHCP, Reply, length 307

Mas a resposta DHCP não pode ser vista no br0001 nem no tap0001:

tcpdump port 67 or port 68 -i br0001 -nN
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0001, link-type EN10MB (Ethernet), capture size 262144 bytes

23:26:33.308296 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 02:00:00:01:01:01, length 356
23:26:37.336875 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 02:00:00:01:01:01, length 356

Alguém poderia me apontar na direção certa, para que as respostas do DHCP sejam enviadas para a VM. Obrigado.