I use a kernel config with only the options selected that I know I use. For firewalld, I have needed to add the following which are not yet listed in CONFIG_CHECK: CONFIG_NF_TABLES_INET CONFIG_IP_NF_SECURITY CONFIG_IP_NF_NAT CONFIG_IP_NF_MANGLE CONFIG_IP6_NF_SECURITY CONFIG_IP6_NF_NAT CONFIG_IP6_NF_MANGLE
It seems further modules are also needed. I will list them here once I discover which and indicate when I think I have a ‘complete’ list.
The issues I encounter with firewalld and missing kernel modules are larger than what I scoped this bug for. Closing. I'll open new bugs once things become clearer.