dhcp subnet snippets are NOT inside the pool block

I'm trying to leverage a combination of a global snippet to "match" hosts into a class and a subnet snippet to deny giving them IP addresses so we can co-exist with openstack DHCP in the same subnet where we provision nodes

Adding a subnet based dhcp snippet to deny these hosts results in it being rendered OUTSIDE of the pool{} block which means snippets like:
deny members of "classname"; will cause DHCP to fail
ISC dhcp docs state that 'deny members of "classname"' rules MUST GO inside of a pool block.

http://www.ipamworldwide.com/ipam/dhcp-declare-allowdeny.html

The improper rendering by maas looks like:

           #
           # Subnet DHCP snippets
           #
           # Name: deny_openstack_192
           deny members of "openstack";
           pool {
              range 10.40.195.200 10.40.195.221;
           }
Whcih causes DHCP to fail to start
Internet Systems Consortium DHCP Server 4.4.1
Copyright 2004-2018 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/
/var/snap/maas/common/maas/dhcpd.conf line 505: expecting allow/deny key
           deny members
                 ^
/var/snap/maas/common/maas/dhcpd.conf line 505: expecting a parameter or declaration
           deny members of "openstack";
                                      ^
Configuration file errors encountered -- exiting

It should have rendered like:
           pool {
               #
               # Subnet DHCP snippets
               #
               # Name: deny_openstack_192
               deny members of "openstack";

              range 10.40.195.200 10.40.195.221;
           }