Description of problem:
On FirewallD you have two options when dealing with DIRECT rules:
... 1) Inserting them temporary using firewall-cmd --direct command;
... 2) Permanently storing them into the XML file (/etc/firewalld/direct.xml);

In RHEL 7.2 the current FirewallD version is 0.3.9.

If the administrator inserts DIRECT rules with lots of destination addresses using method 1, it works and the rule is inserted.
If the method 2 is used, when the administrator reloads FirewallD (firewall-cmd --reload) the rules will not be inserted (decode error, lack of arguments, incomplete arguments).

Version-Release number of selected component (if applicable):
-

How reproducible:
Create some DIRECT rules using firewall-cmd --permanent --direct <RULE> with lots of destination addresses.

Steps to Reproduce:
1. Clear all DIRECT rules, backup your /etc/firewalld/direct.xml file.

2. Clear /etc/firewalld/direct.xml file, insert the rules for testing.
You can break things using this script:
#!/bin/bash
ADDRS=$(for i in $(seq 1 49); do for j in $(seq 1 255); do echo -n "1.1.$i.$j,"; done; done; echo "1.2.0.0")
CMD="firewall-cmd -q --permanent --direct --add-rule ipv4 mangle PREROUTING"
$CMD 1 -s 1.0.0.0/24 -d $ADDRS -j MARK --set-mark 1 -m comment --comment "MARK ADDRS"

3. Reload the firewall (firewall-cmd --reload) and check its logfile (/var/log/firewalld) for parse/command error(s).

Actual results:
Rules are not inserted on firewall because of decode error(s) and/or missing/incomplete iptables arguments.

Example log:
2016-06-24 10:24:32 WARNING: COMMAND_FAILED: '/sbin/iptables -w2 -t mangle -I PREROUTING_direct 1 26.27,1.1.26.28,1.1.26.29,1.1.26.30,1.1.26.31,1.1.26.32,1.1.26.33,1.1.26.34,1.1.26.35,1.1.26.36,1.1.26.37,1.1.26.38,1.1.26.39,1.1.26.40,1.1.26.41,1.1.26.42,1.1.26.43,1.1.26.44,1.1.26.45,1.1.26.46,1.1.26.47,1.1.26.48,1.1.26.49,1.1.26.50,1.1.26.51,1.1.26.52,1.1.26.53,1.1.26.54,1.1.26.55,1.1.26.56,1.1.26.57,1.1.26.58,1.1.26.59,1.1.26.60,1.1.26.61,1.1.26.62,1.1.26.63,1.1.26.6 <SNIP>

Expected results:
All rules on /etc/firewalld/direct.xml should be parsed and inserted properly on the firewall.

Additional info: