old correctly ordered rules:
firewalld-0.6.3-7.el8.noarch
[root@ci-vm-10-0-136-243 tmp.W8lRFVjQny]# nft list chain inet firewalld filter_INPUT_ZONES_SOURCE
table inet firewalld {
	chain filter_INPUT_ZONES_SOURCE {
		ip saddr 192.0.2.10 goto filter_IN_10_it
		ip6 saddr 2001:db8:aaaa::/70 goto filter_IN_10_it
		ip saddr 192.168.2.0/24 goto filter_IN_20_wrk
		ip6 saddr 2001:db8:aaaa::/60 goto filter_IN_20_wrk
		ip saddr 192.168.0.0/22 goto filter_IN_30_vpn
		ip6 saddr 2001:db8:aaaa:16::/64 goto filter_IN_30_vpn
	}
}

new incorrectly ordered rules for zone sources:
firewalld-0.7.0-3.el8.noarch
[root@sheep-71 tmp.RTtUA3nEzE]# nft list chain inet firewalld filter_INPUT_ZONES
table inet firewalld {
	chain filter_INPUT_ZONES {
		ip6 saddr 2001:db8:aaaa:16::/64 goto filter_IN_30_vpn
		ip saddr 192.168.0.0/22 goto filter_IN_30_vpn
		ip6 saddr 2001:db8:aaaa::/60 goto filter_IN_20_wrk
		ip saddr 192.168.2.0/24 goto filter_IN_20_wrk
		ip6 saddr 2001:db8:aaaa::/70 goto filter_IN_10_it
		ip saddr 192.0.2.10 goto filter_IN_10_it
		goto filter_INPUT_ZONES_IFACES
	}
}
[root@sheep-71 tmp.RTtUA3nEzE]# rpm -q firewalld
firewalld-0.7.0-3.el8.noarch

upstream:

  25032eb3a607 ("test: verify source-based zone dispatch ordered by zone name")
  afc35c20e58b ("fix: guarantee zone source dispatch is sorted by zone name")

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2019:3635