Traffic processing BGP Azure VPN gateway A/A

In the active-active mode, Azure runs two active instances of the gateway. Symmetric is not guaranteed, so a packet can enter from one instance and return from the other one.

If you don’t put that UDR on GatewaySubnet, then traffic coming from the VPN gateway into Azure can follow Azure system routes directly to spokes/peering without ever hitting the firewall—so the firewall won’t “see” that direction.

Final, yes it can happen. Azure Firewall is stateful. If only one direction is inspected (or return goes a different path), you can see drops or odd behavior depending on which direction is being inspected and where state is expected.