ZyXEL XMG2230-52HP Anti-ARP Scan

So I've set up Anti-ARP scan on my switch and it seemed to work fine. As soon as I used Netscan, my device got blocked. So far so good, but so did my domain controller with DHCP running on(RTFM 😅). No problem, I added the IP-Address of my DC/DHCP to the Anti-ARP Scan Trust Host and thought everything would be fine.

But today I did a Netscan again and my device didn't block. Weird. The device I use is not domain joined and on a different switch port. As soon as I removed the trust host, it worked again? Is this a bug? Yes I could exclude the port where my DC runs on, but on that same port I also have my RD Gateway VM running on, if that one is compromised, I'd love to have Anti-ARP enabled on it. So that's not an option.

I run on firmware version V2.00(ACNO.1). Also in this firmware there is a bug considering the error count on the ports.(already mentioned that couple of months ago and ZyXEL classified this as bug, but no new firmware has been released since then)

Edit: think I found it. I filled in subnet mask 255.255.255.0 instead of 255.255.255.255, seems to work better now :) my bad