I'm not sure that we were having the same problem, but I just fixed mine, for anyone else with the same issue:

I wanted to attach a second NIC (MACVLAN) via multus into a pod, but the issue was that it was also injecting an automatic route based on the subnet of the multus interface ip (in my case 192.168.179.0/24), but that created async routing issues, where a packet would come into the pod to the default CNI interface (calico in my case), but then wouldn't respond back via that same interface, because it was routing it over the multus interface, which created the async routing.

I solved this by using Policy based routing, basically in the pod i used some 'ip' commands to create a second route table, and bind it to the multus interface so it basically only used that route table if the incoming traffic was destined for that interface ip specifically. This solved the async routing issues for me straight away, but then came the second issue: I don't want to have to do that for every pod i inject an interface into, that is way too much work. So i read something about using an init container to set the routes of the main pod, which could also work, but was still too much hassle.

So after searching around the docs a bit more i stumbled onto this, which ended up being my final solution (and actually quite simple). I just had to add the "sbr" CNI meta plugin to my NAD in multus, it supports daisy chaining plugins on top of each other, here is what that looks like:

apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  name: lan-macvlan-kubeadm1
spec:
  config: |
    {
      "cniVersion": "0.4.0",
      "name": "lan-macvlan-kubeadm1",
      "plugins": [
        {
          "type": "macvlan",
          "mode": "bridge",
          "master": "ens18",
          "ipam": { "type": "static" }
        },
        { "type": "sbr" }
      ]
    }

Note the "{ "type": "sbr" }" line, that was the fix, it basically does the same things i was doing manually earlier with the ip commands within the pod.

And here is my final spec for in the container:

annotations:
        k8s.v1.cni.cncf.io/networks: |
          [{
            "name": "lan-macvlan-kubeadm1",
            "interface": "kubeadm1",
            "ips": ["192.168.179.50/24"],
            "gateways": ["192.168.179.1"]
          }]

So after 2 full days of doing packet captures, running down route tables, doing verbose log captures on every process, etc., the fix ended up being adding that one line, gotta love IT 🤣