Comment 20 for bug 1758037

Ok, repro with local build works.

I tested the buffer sized, the other calls that pcap_open_live does and so on.
Eventually I minimized the changes and found the issue to go away with:

diff --git a/src/nwfilter/nwfilter_dhcpsnoop.c b/src/nwfilter/nwfilter_dhcpsnoop.c
index 6069e70..c12ba9c 100644
--- a/src/nwfilter/nwfilter_dhcpsnoop.c
+++ b/src/nwfilter/nwfilter_dhcpsnoop.c
@@ -1115,7 +1115,6 @@ virNWFilterSnoopDHCPOpen(const char *ifname, virMacAddr *mac,
     }

     if (pcap_set_snaplen(handle, PCAP_PBUFSIZE) < 0 ||
- pcap_set_buffer_size(handle, PCAP_BUFFERSIZE) < 0 ||
         pcap_activate(handle) < 0) {
         virReportError(VIR_ERR_INTERNAL_ERROR,
                        _("setup of pcap handle failed: %s"),

That was defined as:
  /*
   * libpcap 1.5 requires a 128kb buffer
   * 128 kb is bigger than (DHCP_PKT_BURST * PCAP_PBUFSIZE / 2)
   */
  # define PCAP_BUFFERSIZE (128 * 1024)

Maybe with more modern libpcap that is not needed or even wrong now.
I have 1.8.1 atm.