I think the bug is that the client doesn't check the chaddr in replies, only the xid. If so, the Hijack fix might be just to drop on the floor incoming DHCP packets whose chaddr doesn't match our MAC. (Though I'm a bit doubtful about that, as, if such frames are unicast to the right MAC, how come anyone else's IP stack even receives them? Or are they broadcast?)

Probably, Mark, stage one of the process is going to be using Hijack or Wireshark to capture the DHCP traffic and see at what point it all goes wrong.

And it's embarrassing but also a teensy bit surprising that the normal v3a11 gets it wrong -- I'd have thought that at one stage we had a whole office-full of v3a11 players DHCPing at the same time.

Peter