Each new VM makes udev rewrite the device's ACL for the active seat, and WSL has no seat, so a
setfacl entry is gone after the first VM. Membership in the kvm group lasts.
github.com/superradcompany/microsandbox/issues/920 (opens in a new tab)