I actually encountered this again on an upgrade from Debian buster to bullseye. It gave exactly the same symptoms. The solution this time was to `aa-complain chronyd` followed by `aa-enforce chronyd`. It seems that maybe somehow AppArmor was caching an old profile for `chronyd` somewhere, and this somehow survived multiple reboots on my system.
I actually encountered this again on an upgrade from Debian buster to bullseye. It gave exactly the same symptoms. The solution this time was to `aa-complain chronyd` followed by `aa-enforce chronyd`. It seems that maybe somehow AppArmor was caching an old profile for `chronyd` somewhere, and this somehow survived multiple reboots on my system.