DNS replies not sent to dynamic DHCP IPs

[9axqe]

I have a strange problem I could reproduce on TWO devices (both kindles):

Kindle is not receiving replies to its DNS lookups and hence believe it does not have internet.

tcpdump on opnsense shows DNS lookups coming in, I can see them processed by AdGuard, not blocked (NOERROR, correct A records being sent back), but:

there are absolutely no DNS replies in the tcpdump. DHCP replies are properly sent out though. I tried filtering by MAC and IP in tcpdump, same result.

And now the weird bit: in ISC DHCPv4, if I create a static DHCP lease (with static ARP entry), suddenly everything works.

Any idea what the issue can be? The dynamic DHCP IP was 192.168.1.238 while the statically assigned one is 192.168.1.131, but I don't see how that could cause anything.

Originally, because the device moved between vlans (I had them on the guest vlan originally), I thought, maybe something is broken in ARP. But the fact DHCP answers were correctly sent to 192.168.1.238 while DNS answers were not is very puzzling to me, that seems to eliminate any ARP issue, it must be something else, which I really cannot figure out.