Subtraction underestimates the required prefix when IPs span a CIDR boundary (e.g. .110–.119 gave /28 covering only .96–.111, leaving deckies at .112+ unreachable from the host macvlan route). XOR correctly finds the highest differing bit, yielding /27 (.96–.127). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>