Windows RIS now gets as far as downloading NTLDR.

src/interface/pxe/pxe_preboot.c

 #include <stdlib.h>
 #include <gpxe/uaccess.h>
 #include <gpxe/dhcp.h>
+#include <dhcp_basemem.h>
 #include "pxe.h"
 #include "pxe_callbacks.h"
 
 	 * sources of options.
 	 */
 	if ( get_cached_info->BufferLimit == 0 ) {
-		DBG ( " without an external buffer.  Aargh." );
-		goto err;
+		get_cached_info->Buffer.segment = rm_ds;
+		get_cached_info->Buffer.offset =
+			( unsigned int ) ( & __from_data16 ( dhcp_basemem ) );
+		get_cached_info->BufferLimit = sizeof ( dhcp_basemem );
 	}
 
-	DBG ( " to %04x:%04x+%x\n", get_cached_info->Buffer.segment,
+	DBG ( " to %04x:%04x+%x", get_cached_info->Buffer.segment,
 	      get_cached_info->Buffer.offset, get_cached_info->BufferLimit );
 
 	/* Allocate space for temporary copy */
 	/* Copy packet to client buffer */
 	buffer = real_to_user ( get_cached_info->Buffer.segment,
 				get_cached_info->Buffer.offset );
+	len = dhcppkt.len;
 	copy_to_user ( buffer, 0, data, len );
 	get_cached_info->BufferSize = len;
 

src/interface/pxe/pxe_tftp.c

  * @v port		Server port (in network byte order)
  * @v filename		File name
  * @v blksize		Requested block size, or 0
+ *
+ * The URI string buffer must be at least @c PXE_URI_LEN bytes long.
  */
-static void pxe_tftp_build_uri ( char uri_string[PXE_URI_LEN],
+static void pxe_tftp_build_uri ( char *uri_string,
 				 uint32_t ipaddress, unsigned int port,
 				 const unsigned char *filename,
 				 int blksize ) {
 		blksize = TFTP_MAX_BLKSIZE;
 	tftp_set_request_blksize ( blksize );
 
-	snprintf ( uri_string, sizeof ( uri_string ), "tftp://%s:%d%s%s",
+	snprintf ( uri_string, PXE_URI_LEN, "tftp://%s:%d%s%s",
 		   inet_ntoa ( address ), ntohs ( port ),
 		   ( ( filename[0] == '/' ) ? "" : "/" ), filename );
 }
 			     tftp_read_file->FileName, 0 );
 	DBG ( " %s", uri_string );
 
+	DBG ( " to %08lx+%lx", tftp_read_file->Buffer,
+	      tftp_read_file->BufferSize );
+
 	/* Open URI */
 	fd = open ( uri_string );
 	if ( fd < 0 ) {