What one does when one runs out of avc denials and debugging info

One "rules out"

Everything is unconfined except a single domain. If that domain fails
then one rules out which unconfined part fails

This should narrow things down quite a bit

Eventually ones adds individual unconfined rules and that should expose
where the issue is

Needless to say this takes a lot of time as it is "brute force"