This seems like as good a place as any to drop this pearl of wisdom…
cnMatrix switches, when DHCP snooping is enabled, seem to do something with DHCP requests or replies that cause problems when you have multiple tiers of switching with snooping enabled on all of them.
With most other vendors’ switches, you only set a port to “trusted” if it’s actually facing or connected to the DHCP server; with cnMatrix, you also need to “trust” any port that is facing a downstream switch that has snooping enabled.
I would expect this sort of behavior if the downstream switch is configured to inject additional DHCP options (like port-id or something)… but there does not seem to be a way to toggle that behavior that I could see (or at least not in cnMaestro).
TL;DR version: with cnMatrix switches, set ports on both sides of an inter-switch link (the child’s upstream ports, and the parent’s downstream ports) to be “Trusted” if you are running snooping on both switches. Client-facing ports should remain “untrusted” throughout.