[syslinux] UEFI PXE / split config / TFTP attempted to DHCP server, not TFTP server

[Spike White]

All,

I realize this is not strictly a PXELINUX question.  So I hope you'll
indulge me; hopefully some of these PXELINUX experts have seen this before.

And can tell me what I'm doing wrong.  Or confirm my suspicions.

I have a test lab server at work. Split config.  The network team manages
the DHCP servers, points to our TFTP server.

Test subnet has 3 DHCP pools.  BIOS PXE, UEFI PXE and catch-all (straight
DHCP).

DHCP server is filtering on client's initial VCI (option 60).
   PXEClient:Arch:00000* => BIOS PXE boot client
   PXEClient:Arch:00007* => UEFI PXE boot client
   empty => std DHCP request

This is all working correctly.  Based on the OFFERed DHCP addresses (&
wireshark analysis), I can tell it's being associated with the correct DHCP
pool in all cases.

My PXE BIOS boot and std DHCP requests are working fine.

My problem is with UEFI boot.  It goes through the "DORA" conversation with
the DHCP server fine.  (DISCOVER-OFFER-REQUEST-ACK).

Then it attempts to TFTP from the DHCP server instead of the TFTP server!!
(Which of course fails.)  This only occurs with UEFI; under BIOS boot it
properly requests from the TFTP server.

My test server is a Dell R710 server, which is a 3-4 year old server.  It
does
BIOS boot by default, but will do UEFI boot.

Here are the relevant DHCP options I have set in my UEFI pool:
    next-server (BOOTP flag) -- set to TFTP server's IP address
    filename (BOOTP flag) -- set to UEFI NBP's full path

    Domain name (15) -- set to DNS domain name
    TFTP Server Name (66) -- a string.  I have tried:
         - TFTP Server's IP address (as string),
         - FQDN,
         - short name

    bootfile-name (67) -- set UEFI NBP's full path

The OFFER & ACK packets additionally have this relevant option set:
    DHCP Server Identifier (54) -- DHCP server's IP address

I do this same split config at my house (VMWare workstation 10.0 Hardware
Compatibility) and it works fine.  That is, it does the initial DORA
conversation, then correctly does the TFTP read request of the UEFI NBP from
the TFTP server.

So I strongly suspect this is a bug in the Dell R710 UEFI boot firmware
code.
(BTW, I'm using the embedded Broadcom NIC that comes w/ the R710).  I have
flashed the BIOS and NIC firmware up to latest from vendor.

Has anyone else ever seen this?  Does anyone else do a split config?

Spike