I saw some instructions for running a Debian host with KVM and a Debian guest inside a KVM VM. And some of these instructions didn’t require dnsmasq.
Maybe dnsmasq is required as per, quote libvirt: Running your own dnsmasq with libvirtd
On linux host servers, libvirtd uses dnsmasq to service the virtual networks, such as the default network. A new instance of dnsmasq is started for each virtual network, only accessible to guests in that specific network.
But that doesn’t sound like the host dnsmasq systemd unit is required. Could you test please to disable the host dnsmasq systemd unit? (The package dnsmasq can remain being installed.)
Check if running:
sudo systemctl status dnsmasq
Then stop it.
sudo systemctl stop dnsmasq
Does that break Whonix-Gateway connectivity?
Does that break Whonix-Workstation connectivity?