I still can't work out how to report stuff to Cisco so I'm just going to post here. SG350-10 10-Port In 2.5.7.85 ACL is done first then DAL in 2.5.8.12 DAI is done first then ACL Traffic can now leak under DHCP ports in 2.5.8.12 part of ACL rulePrior...