Assigning to myself as I plan to finish the integration work I already started a long time ago (see mentioned patch, not even posted upstream though). However, I'd be more than happy if somebody wants to pick this up.

Apologies for the long time without an update here. We have done a substantial amount of work with Laine:

- instead of using the "client" type as network source, we are adding a "passt" back-end type in the "user" network interface type, given that the passt service should be managed by libvirt and we also need to add a set of possible configuration options in this section of the XML schema

- relevant domain XML parts and lifecycle details are sketched for the moment at: https://pad.passt.top/p/libvirt

- Laine is now working on parsing of the new XML schema and on the implementation that runs passt before the guest is started

Reassigning to Laine as he's working on the implementation now.

support for passt has been pushed to libvirt upstream, and is included in libvirt-9.0.0, which is intended to be the libvirt release used in RHEL 9.2.

Here is an example of the XML for an emulated virtio interface that uses passt

     <interface type='user'>
       <model type='virtio'/>
       <backend type='passt' logFile='/tmp/xyzzy.log'/>
       <mac address="00:11:22:33:44:55"/>
       <source dev='eth0'/>
       <ip family='ipv4' address='172.17.2.4' prefix='24'/>
       <ip family='ipv6' address='2001:db8:ac10:fd01::20'/>
       <portForward proto='tcp'>
         <range start='2022' to='22'/>
       </portForward>
       <portForward proto='udp' address='1.2.3.4'>
         <range start='5000' end='5020' to='6000'/>
         <range start='5010' end='5015' exclude='yes'/>
       </portForward>
       <portForward proto='tcp' address='2001:db8:ac10:fd01::1:10'>>
         <range start='8080' to='80'/>
         <range start='4433' to='443'/>
       </portForward>
     </interface>

Here is the commandline of the passt process that is executed (as user qemu:qemu) by libvirt:

usr/bin/passt --one-off --socket /run/libvirt/qemu/passt/1-passt-net0.socket \
              --mac-addr 00:11:22:33:44:55 \
              --interface eth0 \
              --log-file /tmp/xyzzy.log \
              --address 172.17.2.4 --netmask 24 \
              --address 2001:db8:ac10:fd01::20 \
              --tcp-ports 2022:22
              --udp-ports 1.2.3.4/5000-5020:6000-6020,~5010-5015
              --tcp-ports 2001:db8:ac10:fd01::1:10/8080:80,4433:443

Some caveats:

* installation of the passt package is only "Recommended" in the libvirt RPM, not "Required", so it will need to be explicitly installed to test

* until passt has the proper SELinux policy for /usr/bin/passt, SELinux must be set to permissive

* forwarding ports < 1024 requires special configuration of the host outside libvirt - see the passt manpage

Test with packages as below, guest can start successfully, and network function and port forwarding works well.
Set the bug as verified:tested.

libvirt-9.0.0-2.el9.x86_64
qemu-kvm-7.2.0-5.el9.x86_64
passt-0^20221110.g4129764-1.el9.x86_64

1. Prepare the env and the xml, then start the vm:
$ getenforce 
Permissive

$ whoami
test

$ virsh dumpxml test --xpath //interface 
<interface type="user">
  <mac address="52:54:00:01:db:cd"/>
  <source dev="eno1"/>
  <ip address="172.100.100.5" family="ipv4" prefix="24"/>
  <ip address="2001:db8:ac10:fd01::20" family="ipv6"/>
  <portForward proto="tcp">
    <range start="2022" to="22"/>
  </portForward>
  <model type="virtio"/>
  <backend type="passt" logFile="/home/test/passt.log"/>
  <alias name="net0"/>
  <address type="pci" domain="0x0000" bus="0x10" slot="0x01" function="0x0"/>
</interface>

$ virsh start test 
Domain 'test' started

2. Check the passt process and qemu log of the vm:
Check the vm's log:
2023-02-02 05:21:46.873+0000: Starting external device: passt
/usr/bin/passt --one-off --socket /home/test/.cache/libvirt/qemu/run/passt/1-test-net0.socket --mac-addr 52:54:00:01:db:cd --interface eno1 --log-file /home/test/passt.log --address 172.100.100.5 --netmask 24 --address 2001:db8:ac10:fd01::20 --tcp-ports 2022:22
2023-02-02 05:21:46.880+0000: starting up libvirt version: 9.0.0, package: 2.el9 (Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>, 2023-01-25-04:45:27, ), qemu version: 7.2.0qemu-kvm-7.2.0-5.el9, kernel: 5.14.0-249.el9.x86_64, .......
-netdev '{"type":"stream","addr":{"type":"unix","path":"/home/test/.cache/libvirt/qemu/run/passt/1-test-net0.socket"},"server":false,"id":"hostnet0"}' \
-device '{"driver":"virtio-net-pci","netdev":"hostnet0","id":"net0","mac":"52:54:00:01:db:cd","bus":"pci.16","addr":"0x1"}' 

Check the passt process:
$ ps aux | grep  '/usr/bin/passt' | grep -v grep
test        6971  0.0  0.0  85584 42640 ?        Ss   00:21   0:00 /usr/bin/passt --one-off --socket /home/test/.cache/libvirt/qemu/run/passt/1-test-net0.socket --mac-addr 52:54:00:01:db:cd --interface eno1 --log-file /home/test/passt.log --address 172.100.100.5 --netmask 24 --address 2001:db8:ac10:fd01::20 --tcp-ports 2022:22

3. Login the vm and check the ip address, the ipv4 and ipv6 addresses are as expected, except the ipv4 address netmask. And the namesever and default route are the same with the host, which is as expected.

# ip addr show ens1
2: ens1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65520 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:01:db:cd brd ff:ff:ff:ff:ff:ff
    altname enp2s1
    inet 172.100.100.5/8 brd 172.255.255.255 scope global noprefixroute ens1
       valid_lft forever preferred_lft forever
    inet6 2001:db8:ac10:fd01::20/128 scope global noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 2001:db8:ac10:fd01:ebe7:70a:36e1:43c3/64 scope global dynamic noprefixroute 
       valid_lft 2599sec preferred_lft 2599sec
    inet6 fe80::38f1:f32:9e5e:2647/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever


# cat /etc/resolv.conf 
(same with the host)

# ip route 
(default route same with the host)
172.0.0.0/8 dev ens1 proto kernel scope link src 172.100.100.5 metric 100

# ip -6  route
::1 dev lo proto kernel metric 256 pref medium
2001:db8:ac10:fd01::20 dev ens1 proto kernel metric 100 pref medium
2001:db8:ac10:fd01::/64 dev ens1 proto ra metric 100 pref medium
fe80::/64 dev ens1 proto kernel metric 1024 pref medium
default via fe80::3e8c:9302:ef60:52a1 dev ens1 proto ra metric 100 pref medium
(default route same with the host)

4. Check the network function of the guest, it works properly:
# ping -4 www.google.com -c 2
(succeed)
# yum install -y vim
(succeed)
Try to access another host from the vm:
# ssh root.xx.xx
(succeed)

5. Test port forwarding both for tcp ipv4 and ipv6, it is expected.
On local host host, try to access the guest by ssh ipv6:
# ssh -p 2022 root@localhost
The authenticity of host '[localhost]:2022 ([::1]:2022)' can't be established.
ED25519 key fingerprint is SHA256:HjpnGK0NmRVTk56n/iJLoMouik8Vr/Lalz5KSS0yFlg.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[localhost]:2022' (ED25519) to the list of known hosts.
root@localhost's password: 
Last login: Thu Feb  2 14:19:47 2023
[root@cpe-172-100-100-5 ~]# exit
logout
Connection to localhost closed.
# ssh -p 2022 -4  root@localhost
root@localhost's password: 
Last login: Thu Feb  2 14:20:58 2023 from fe80::3e8c:9302:ef60:52a1%enp1s0
[root@cpe-172-100-100-5 ~]# 

6. destroy the host, check the passt process killed
$ virsh destroy test 
Domain 'test' destroyed
$ ps aux | grep passt | grep -v grep 
(nothing)

Move the bug to verified per comment 8. The network function and port forwarding works well. 
There are some questions under clarifing with developers, I will summarize it later and file new bugs if needed.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (libvirt bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2171