pre_interface_freeform silently dropped on NDFC < 12.2.2 / ND <= 3.2.1 -> fabric stuck Out-of-Sync

[dacasti2mx]

Ansible Version

ansible [core 2.16.3]

Ansible Collection Versions

cisco.nac_dc_vxlan 0.8.1-dev
cisco.dcnm         3.12.0-dev
cisco.nxos         10.2.0

Cisco Nexus Dashboard Version

ND 3.1.1n  (NDFC 12.2.1.316)

Cisco NX-OS Version

10.6(2)

Which role is this issue related to?

cisco.nac_dc_vxlan.dtc.create

Which section of the data model is this issue related to?

vxlan.global

Expected Behavior

The policy-map from *_pre_interface_freeform must be created on the switch BEFORE the
intra_fabric_link_freeform service-policy references it. If the target NDFC/ND version
does not support 'preInterfaceConfig', the collection should FAIL clearly (pointing the
user to vxlan.policy / switch_freeform) instead of silently dropping the policy-map while
still pushing the dependent service-policy.

Actual Behavior

The fabric freeform template
roles/dtc/common/templates/ndfc_fabric/dc_vxlan_fabric/freeform/dc_vxlan_fabric_freeform.j2
only emits preInterfaceConfig{Spine,Leaf,Tor} when:

    ndfc_version >= 12.2.2  AND  nd_version > 3.2.1

On ND 3.1 / NDFC 12.2.1 this is false, so leaf/spine_pre_interface_freeform (the policy-map)
is dropped. But intra_fabric_link_freeform (the service-policy) is emitted unconditionally
via EXTRA_CONF_INTRA_LINKS. NDFC then applies a service-policy that references a policy-map
it never created -> the switch rejects it -> the fabric never reaches In-Sync (deploy retries
check_sync 60x and ends with "Fabric ... is out of sync after deployment").

Ansible Playbook

- name: Manage VXLAN Fabric
  hosts: ndfc
  gather_facts: false
  roles:
    - cisco.nac_dc_vxlan.dtc.create
    - cisco.nac_dc_vxlan.dtc.deploy

Data Model

vxlan:
  global:
    ibgp:
      # applies the QoS service-policy on every intra-fabric (underlay) link
      intra_fabric_link_freeform:
        service-policy type qos input port_qos_policy
      # meant to CREATE the policy-map before the interface references it
      leaf_pre_interface_freeform:
        policy-map type qos port_qos_policy
      spine_pre_interface_freeform:
        policy-map type qos port_qos_policy

Steps to Reproduce

1. Target ND 3.1 (NDFC 12.2.1). Define a VXLAN_EVPN fabric with the data model above.
2. Run: ansible-playbook -i inventory vxlan.yaml -l <fabric>
3. create pushes the fabric; deploy runs config-deploy (RETURN_CODE 200) but check_sync never converges.
4. On the switch / NDFC config-preview: "service-policy type qos input port_qos_policy" is pending
   on the intra-fabric interface, but no "policy-map type qos port_qos_policy" exists.

Relevant Debug Output

DEPLOY [<fabric>] check_sync -> out of sync, retry 60/60
DEPLOY [<fabric>] check_sync -> warning (in_sync=False)
fatal: [<fabric>]: FAILED! => {
  "fabric_history": [{
    "configResponseList": [
      { "command": "interface ethernet1/2", "status": "SUCCESS" },
      { "cliResp": "Delivery failed with message:cannot apply non-existing policy to interface",
        "command": "  service-policy type qos input port_qos_policy",
        "status": "FAILED" }
    ],
    "entityType": "INTERFACE", "source": "UNDERLAY", "status": "FAILED"
  }],
  "msg": "Fabric <fabric> is out of sync after deployment."
}