Thanks for the link, that is some interesting info. I've only skimmed it, but yes, I'm aware that DHCP requests can be made without a discover phase (I've had to read the RFC to implement DHCP in NCD ;).

I suspect that it's not actually directly doing some low-level ARP magic; rather the DHCP client may just be sending multiple DHCP request packets to past DHCP servers, and only the one whose automatic ARP request succeeds actually gets sent out. At least that'd how I would implement it.