OK, it seem this is not working after all and I am really struggling to understand why.
The issue exists under 2.4.5 and 2.4.5-1. But not 2.4.4-3.
the LAN interface is a bridge comprising vtnet0 and vtnet1.10.
vtnet1.10 currently carries traffic, via managed switch, from an Asus access point (both Wireless and wired).
pfSense is a Proxmox VM with vtnet0 & vtnet1 on Proxmox bridges. Latter bridge is set 'VLAN aware'.
All devices on the bridge are in the same subnet 192.168.0.0/24.
pfSense's IP on LAN (bridge) interface is 192.168.0.1.
Under pfSense 2.4.4-3, hosts connected to vtnet0 (eg proxy, pihole) see the real IP of incoming connections from clients on vtnet1.10. No problem.
Under pfSense 2.4.5+, this is also true. Other than for DNS traffic: Hosts on vtnet0 will always see the pfsense LAN IP 192.168.0.1 as the remote device. The DNS replies are still successfully received. The effect is something akin to NAT between the two component interfaces of the bridge, but only for DNS traffic.
I have dumped the nat & firewall rules from the command line and do not see anything that might target DNS specifically in this situation. As I say, it worked OK under pfSense 2.4.4-3. The pihole could discern the ip addresses of all the clients. Now it only sees those on vtnet0 and for those on vtnet1.10, it only ses the pfsense LAN IP.