Please check if any pci device is attached to sys-firewall (it should return an error):
$ qvm-pci ls sys-firewall
If instead some controller is attached to sys-firewall, you should detach it:
$ controller_id=$(qvm-pci ls sys-firewall | grep dom0 | awk '{print $1}')
$ qvm-pci detach sys-firewall $controller_id
Also, what template is sys-net based on? If you don’t know check with:
$ qvm-prefs sys-net template
Finally, check which pci controller is attached to sys-net, then re-attach it with the no-strict-reset parameter:
$ controller_id=$(qvm-pci ls sys-net | grep dom0 | awk '{print $1}')
$ qvm-pci detach -v sys-net $controller_id
$ qvm-pci attach -v --persistent --option no-strict-reset=True sys-net $controller_id