There was a bug in the npc analyser when adding a netpol with dstSelector == srcSelector. The analyser was overwriting dstSelector with srcSelector which resulted in Pod selected by dstSelector not being removed from a corresponding "default-allow" ipset. This applies only to non-legacy netpols.