On 2. The profile reload automatically gave the guest (and only that guest) the right device - in my case /dev/vfio/41. So the profile reload is good.
[ 2652.751699] audit: type=1400 audit(1491303691.711:24): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="libvirt-17a61b87-5132-497c-b928-421ac2ee0c8a" pid=8757 comm="apparmor_parser"
On 2.
The profile reload automatically gave the guest (and only that guest) the right device - in my case /dev/vfio/41. So the profile reload is good.
[ 2652.751699] audit: type=1400 audit(149130369 1.711:24) : apparmor="STATUS" operation= "profile_ replace" profile= "unconfined" name="libvirt- 17a61b87- 5132-497c- b928-421ac2ee0c 8a" pid=8757 comm="apparmor_ parser"