I have my home server as well as my HA device on my primary 192.168.1.x network.
My kasa devices are on my IOT 192.168.100.x subnet.

I would would like to discover the Kasa devices on the IOT subnet (br1, vlan3) from my primary 192.168.1.x subnet (br0) -- whether via HA or via the CLI kasa discover

In the HA TP-Link integration, I can manually discover individual devices across subnets if I give the host IP -- but not if I leave the host blank and seek to "auto-discover".

Similarly, direct host addressing using CLI kasa --target 192.168.100.144 discover works (where 192.168.100.144 is a Kasa device on my IOT network). Though strangely kasa --host 192.168.100.144 discover returns after a second but without any discovery data suggesting that it connects but somehow returns no data.

In contrast, "auto discovery" using kasa discover' or even 'kasa --target 192.168.100.255 times out after ten seconds, returning:

Discovering devices on 192.168.100.255 for 10 seconds
Found 0 devices

I assume that the problem is that "auto" discovery is using broadcast (255.255.255.255) on ports 9999 and 20002 -- but of course broadcast messages are not forwarded across subnets, i.e, from 192.168.1.x (br0) to 192.168.100.x (br1) whereas specifying a specific host IP just sends the discovery packet directly to the host IP address on ports 9999 and 2002.

Indeed tcpdump confirms the broadcast originating on br0:

# tcpdump  -i br0 \( udp port 9999 or \udp port 20002 \)
...
11:34:02.081514 IP homeassistant.mydomain.35965 > 255.255.255.255.9999: UDP, length 29
11:34:02.081539 IP homeassistant.mydomain.35965 > 255.255.255.255.20002: UDP, length 501
11:34:03.749051 IP homeassistant.mydomain.35965 > 255.255.255.255.9999: UDP, length 29
11:34:03.749076 IP homeassistant.mydomain.35965 > 255.255.255.255.20002: UDP, length 501
11:34:05.416139 IP homeassistant.mydomain.35965 > 255.255.255.255.9999: UDP, length 29
11:34:05.416165 IP homeassistant.mydomain.35965 > 255.255.255.255.20002: UDP, length 501

but tcpdump -i br1 \( udp port 9999 or \udp port 20002 \) doesn't show any traffic.

So to summarize, my questions are:

1. Why does kasa --target 192.168.100.144 discover succeed while, kasa --host 192.168.100.144 discover fails?
2. Is there any way to get kasa --target 192.168.100.255 discover working where the target is on a different subnet?
3. More generally, how can I get auto-discovery (without specifying the host IP) to work across subnets -- both in the CLI and in the HA TP-Link integration?
   This is particularly important to me in HA since I would rather not have to type in each IP individually - plus presumably the IP address can change.

Note I am using version python-kasa-0.8.1