The following items are relevant (but it was absolutely correct that you’ve posted a complete one!):
/interface vlan
add interface=bridge-LAN name=vlan832-wan vlan-id=832
/interface bridge port
add bridge=bridge-LAN comment=defconf frame-types=admit-only-vlan-tagged interface=sfp-wan
/interface bridge vlan
add bridge=bridge-LAN tagged=sfp-wan,bridge-LAN vlan-ids=832
/interface bridge filter
add action=set-priority chain=output dst-port=67 ip-protocol=udp mac-protocol=ip new-priority=6 out-interface=vlan832-wan passthrough=yes
The thing is that there is a slight mess in item naming. In the bridge filter rules, interface refers to interfaces that can be member ports of a bridge; in the ip firewall rules, _interface_refers to interfaces to which IP configuration can be attached. Moreover, the actual path of the packet is the following:
IP stack → (U)vlan832-wan(T) → bridge(interface of the router) → bridge(port of virtual switch) → bridge(the virtual switch itself) → sfp-wan(port of virtual switch)
If it looks confusing, read this.
So the vlan interface attached to the bridge-facing interface of the router, vlan832-wan, is not a member port of the bridge and the rule can never match. So change the rule as follows:
out-interface=sfp-wan chain=output mac-protocol=vlan vlan-encap=ip ip-protocol=udp dst-port=67 action=set-priority new-priority=6
and try again.
Btw, passthrough=yes has little use here as it only affects handlings of packets that did match the rule, and those that did match any of your rules do not need to proceed to any of the subsequent ones.