Now capable of sending what, to me, looks like a valid DHCPDISCOVER

(apart from the bad UDP checksum).

src/include/gpxe/dhcp.h

 #include <gpxe/udp.h>
 #include <gpxe/async.h>
 
+/** BOOTP/DHCP server port */
+#define BOOTPS_PORT 67
+
+/** BOOTP/DHCP client port */
+#define BOOTPC_PORT 68
+
 /** Construct a tag value for an encapsulated option
  *
  * This tag value can be passed to Etherboot functions when searching
 	uint32_t magic;
 	/** DHCP options
 	 *
-	 * Variable length; extends to the end of the packet.
+	 * Variable length; extends to the end of the packet.  Minimum
+	 * length (for the sake of sanity) is 1, to allow for a single
+	 * @c DHCP_END tag.
 	 */
-	uint8_t options[0];
+	uint8_t options[1];
 };
 
 /** Opcode for a request from client to server */

src/net/udp/dhcp.c

 					     DHCP_OPTION_OVERLOAD_SNAME );
 	int rc;
 
+	/* Sanity check */
+	if ( max_len < sizeof ( *dhcphdr ) )
+		return -ENOSPC;
+
 	/* Initialise DHCP packet content */
 	memset ( dhcphdr, 0, max_len );
 	dhcphdr->xid = dhcp->xid;
 	return container_of ( conn, struct dhcp_session, udp );
 }
 
+/** Address for transmitting DHCP requests */
+static struct sockaddr sa_dhcp_server = {
+	.sa_family = AF_INET,
+	.sin = {
+		.sin_addr.s_addr = INADDR_BROADCAST,
+		.sin_port = htons ( BOOTPS_PORT ),
+	},
+};
+
 /**
  * Transmit DHCP request
  *
 	}
 
 	/* Transmit the packet */
-	udp_send ( conn, dhcppkt.dhcphdr, dhcppkt.len );
+	if ( ( rc = udp_sendto ( conn, &sa_dhcp_server,
+				 dhcppkt.dhcphdr, dhcppkt.len ) ) != 0 ) {
+		DBG ( "Could not transmit UDP packet\n" );
+		return;
+	}
 }
 
 /**
  * @ret aop		Asynchronous operation
  */
 struct async_operation * start_dhcp ( struct dhcp_session *dhcp ) {
+	int rc;
+
 	dhcp->udp.udp_op = &dhcp_udp_operations;
 	dhcp->state = DHCPDISCOVER;
 	/* Use least significant 32 bits of link-layer address as XID */
 			       + dhcp->netdev->ll_protocol->ll_addr_len
 			       - sizeof ( dhcp->xid ) ), sizeof ( dhcp->xid ));
 
+	/* Bind to local port */
+	if ( ( rc = udp_open ( &dhcp->udp, BOOTPC_PORT ) ) != 0 ) {
+		async_done ( &dhcp->aop, rc );
+		goto out;
+	}
+
 	/* Proof of concept: just send a single DHCPDISCOVER */
 	udp_senddata ( &dhcp->udp );
 
+ out:
 	return &dhcp->aop;
 }