Kernel debug (fw ctl zdebug + drop) shows the following drops:
dropped by fwpslglue_chain Reason: PSL Reject: internal - reject enabled
or
dropped by fwpslglue_chain Reason: PSL Drop: internal - drop enabled
The policy files were corrupted during the migration.