Adding an untagged veth to the CT did not work as expected either:
NETIF="ifname=eth0,bridge=vmbr0,mac=BE:A3:F8:E2:73:E0,host_ifname=veth103.0,host_mac=F6:5A:BA:DE:60:0E;ifname=eth1,bridge=vmbr0,mac=A2:38:7F:B8:C3:D4,host_ifname=veth103.1,host_mac=46:CC:6C:C7:DA:3F"
root@pve1:~# ovs-vsctl...