Failed: Found conflicts with NetworkIntentPolicy

Running the prepareSubnet.ps1 fails with the following error:

Selecting subscription 'REDACTED'.
Subscription selected.
Loading virtual network 'vnw-redacted-dev-az1-vnet' in resource group 'rsg-redacted-dev-az1-vnet'.
Virtual network loaded.
Loading subnet 'sbt-redacted-app'.
Subnet loaded.

Verifying subnet 'sbt-redacted-app'.
Passed Validation - Subnet is of enough size.
Passed Validation - There are no conflicting resources inside the subnet.
Verifying DNS servers list for virtual network 'vnw-redacted-dev-az1-vnet'.
Passed Validation - DNS Servers List.
Verifying Service endpoints for subnet 'sbt-redacted-app'.
Passed Validation - No service endpoints.
Verifying Network security group for subnet 'sbt-redacted-app'.
Loading Network security group for subnet 'sbt-redacted-app'.
Warning - Network security group needs modifications.
Verifying RT for subnet 'sbt-redacted-app'.
Loading Route table for subnet 'sbt-redacted-app'.
Route table loaded.
Verifying Route table 'rtb-redacted-dev-az1-app'.

Exception calling "ToUInt32" with "1" argument(s): "Input string was not in a correct format."
At /home/jenkins/workspace/module-tests/scripts/prepareSubnet.ps1:284 char:5
+     $ipnum = ([Convert]::ToUInt32($cidrRangeParts[0]) -shl 24) -bor `
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : FormatException

Exception calling "ToUInt32" with "1" argument(s): "Input string was not in a correct format."
At /home/jenkins/workspace/module-tests/scripts/prepareSubnet.ps1:284 char:5
+     $ipnum = ([Convert]::ToUInt32($cidrRangeParts[0]) -shl 24) -bor `
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : FormatException

Exception calling "ToUInt32" with "1" argument(s): "Input string was not in a correct format."
At /home/jenkins/workspace/module-tests/scripts/prepareSubnet.ps1:284 char:5
+     $ipnum = ([Convert]::ToUInt32($cidrRangeParts[0]) -shl 24) -bor `
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : FormatException

Passed Validation - Route table.

----------  To prepare the virtual network subnet for Managed Instance this script will: ---------------

[NSG] Create a copy of assoicated Network security group and add security rules to:
[NSG] Associate newly created Network security group to subnet.

--------------------------------------------------------------------------------------------------------

Creating Network security group.
Associating Network security group.
Applying changes to the virtual network.
Failed: Found conflicts with NetworkIntentPolicy. Details: Subnet or Virtual Network cannot have resources or properties which conflict with network intent policy.
Network Security Group: /subscriptions/REDACTED/resourceGroups/rsg-redacted-dev-az1-vnet/providers/Microsoft.Network/networkSecurityGroups/nsgManagedInstance366 conflicts with Network Intent Policy: 51b0238a-85d9-450a-9991-ce5f7831089c
    Network Security Group doesn't have supporting Security Rule for Network Intent Policy Security Rule: Name: mi-sql-management-inbound, Id: /subscriptions/REDACTED/resourceGroups/rsg-redacted-dev-az1-vnet/providers/Microsoft.Network/networkIntentPolicies/51b0238a-85d9-450a-9991-ce5f7831089c/securityRules/mi-sql-management-inbound, Access: Allow, Direction: Inbound, Protocol: Tcp, SourceAddressPrefix: Internet, SourcePortRange: *, DestinationAddressPrefix: x.y.z.w/27, DestinationPortRange: 9000;9003;1438;1440;1452
    ----
    Network Security Group doesn't have supporting Security Rule for Network Intent Policy Security Rule: Name: mi-allow-internal-inbound, Id: /subscriptions/REDACTED/resourceGroups/rsg-redacted-dev-az1-vnet/providers/Microsoft.Network/networkIntentPolicies/51b0238a-85d9-450a-9991-ce5f7831089c/securityRules/mi-allow-internal-inbound, Access: Allow, Direction: Inbound, Protocol: *, SourceAddressPrefix: x.y.z.w/27, SourcePortRange: *, DestinationAddressPrefix: x.y.z.w/27, DestinationPortRange: *
    ----
    Network Security Group doesn't have supporting Security Rule for Network Intent Policy Security Rule: Name: mi-allow-internal-outbound, Id: /subscriptions/REDACTED/resourceGroups/rsg-redacted-dev-az1-vnet/providers/Microsoft.Network/networkIntentPolicies/51b0238a-85d9-450a-9991-ce5f7831089c/securityRules/mi-allow-internal-outbound, Access: Allow, Direction: Outbound, Protocol: *, SourceAddressPrefix: x.y.z.w/27, SourcePortRange: *, DestinationAddressPrefix: x.y.z.w/27, DestinationPortRange: *
    ----
---- ----
StatusCode: 400
ReasonPhrase: Bad Request
OperationID : '17943ea1-4d45-48fb-84ff-1067a60b9ef8'

Subnet prepared for the Managed Instance.
https://portal.azure.com/#create/Microsoft.SQLManagedInstance

This blocks from deploying sql mi.

Start with scripts/prepareSubnet.ps1 around line 284 and reproduce the failure while preparing the subnet with its route table. Trace the CIDR value passed to ToUInt32 and verify the resulting Network Security Group satisfies the reported NetworkIntentPolicy rules; done means the script completes without the format exceptions or the conflict response.