Thanks for the replies.
That gave no output. I would try the other suggestions, but I flashed an older image to the device which uses fw3 and that does work. I don't know what else isn't working and need to control access to devices here. Will have to get a spare RPi4 to use for development testing with this.
I did open FS#4258 since this behavior was confirmed by another user.
@dave14305 @anon98444528 - Either of you running with fw4? Care to make that rule and see what you can determine?