Ah, running dhclient3 eth0 manually gave
dhclient3 eth0
RTNETLINK answers: Operation not permitted
RTNETLINK answers: Operation not permitted
And I tracked it down as apparmor denial on host:
Sep 05 12:01:09 kernel: audit: type=1400 audit(1725534069.603:228): apparmor="DENIED" operation="capable" class="cap" namespace="root//lxd-c1_<var-lib-lxd>" profile="/sbin/dhclient" pid=28122 comm="ip" capability=12 capname="net_admin"
@amikhalitsyn could this be another regression related to updated apparmor parser version in LXD 5.21.2 LTS interim snap release 5.21.2-22f93f4 (and 5.21.2-2f4ba6b) and latest/stable?