Those "pending changes" message is caused by the ipset_chain_digest function from PVE/Firewall.pm which did not got updated to userspace changes at least in ipset 7.7 (documented here).
Calling
will show the changing of the initval hex encoded value.
So any calculated hash which includes this...