I cleared the input chain and set the policy to accept, and the SB can now see Firefly. I’m still mucking around trying to figure out exactly which rule is hosing things.
Note that could be a red herring. Even if the mdns reponder doens’t get mdns queries (which would break mdns resolving), when the service starts, it spams out mdns announcements for pre-caching. So starting the mt-daapd server (if the outbound mdns works) will populate the mdns browse lists of clients even if mdns isn’t totally working.
You’ll know you have a “mdns server not recieving mdns queries” problem if it periodically drops off (server not available, or disappears from iTunes browse) after 10 minutes or so.