I think you're right that it is working as intended, but I do think that, due to the way Apple handle it on their devices, there could be ways to fine-tune it, i.e. when you click yes block doh an extra option to also include iCloud PR. Or don't block for devices connected to the router via VPN.There is nothing to fix, it's working as intended. If you don't want to block it, then disable the option that blocks it.
The VPN is the big issue for me. After 388.7 whenever I connected to the router via VPN, iOS thought my cellular network was blocking iCloud PR and prompting me to disable PR entirely for cellular, which I don't want to do. I thought I would have to disable iCloud PR entirely or allow DoH entirely, but luckily @dave14305 's script saved me on that one to basically keep PR enabled.
Again, this is completely Apple's fault for the stupid way they implement it, but there could be ways to fine-tune it on Asuswrt-Merlin's end for a better experience for certain situations where Apple users generally want to block automatic DoH for home LAN devices, but keep iCloud PR on mobile devices (and be able to connect back to LAN VPN occasionally).
Of course, in an ideal world this would be up to Apple to fix, and there should be an on-device option to automatically disable iCloud PR when certain VPN connections are initiated and re-enabled when disconnected. But not like they have the money to devote to that....
Last edited: