Another user is troubleshooting connectivity problems too.
Apparently Debian distinguishes between dnsmasq and dnsmasq-base. Can you make sure both are installed and report back?
So for Kicksecure and Whonix we mask systemd daemons including DHCP to reduce chance of leaks and attack surface. Maybe libvirt depends on it somehow.
I don’t know which of the half dozen systemd network daemons is broken here. There’s systemd-resolve, systemd-networkd @Patrick what services do we mask?
Try installing isc-dhcp-server and see if that solves it.