My understanding is that the new(ish) DMA protection prevents IOMMU groups from being broken up if the device doesn’t support DMA remapping.
Trying to start the (K)VM resulted in “error starting domain internal error […] failed to set group invalid argument”
The output of sudo dmesg | grep -i IOMMU ended with
Firmware has requested this device have a 1:1 IOMMU mapping, rejecting configuring the device without a 1:1 mapping. Contact your platform vendor
For me this was fixed by Disabling “Kernel DMA Protection Indicator” in my MSI BIOS (Advanced/Overclocking/Advanced CPU Configuration/AMD CBS - the setting for “Pre-boot DMA Protection” had no effect), though it was throwing an error specifically for the (old) sound card I pass through and presumably not the GPU because the GPU is earlier on in the XML file for the KVM. In my case, I have multiple other devices in the same IOMMU group as the sound card that were not passed through (mainly Chipset PCIe Switch Downstream Ports), which was working fine until the BIOS with AGESA update I did.
“Kernel DMA Protection Indicator” effectively allows for OS-level DMA-remapping via IOMMU. Enabling this for Windows-based systems provides for “Memory Access Protection.”
It is important to note that not all device drivers support DMA-remapping.
Unless you specifically require security hardening due to physical access concerns to your machine, I recommend disabling this feature along with Pre-boot DMA Protection.
More from MS:
Kernel DMA Protection | Microsoft Learn