Index: slirp/bootp.c
===================================================================
RCS file: /sources/qemu/qemu/slirp/bootp.c,v
retrieving revision 1.8
diff -u -r1.8 bootp.c
--- slirp/bootp.c	16 Apr 2006 11:06:58 -0000	1.8
+++ slirp/bootp.c	21 Oct 2006 02:29:36 -0000
@@ -184,6 +184,12 @@
     rbp->bp_yiaddr = daddr.sin_addr; /* Client IP address */
     rbp->bp_siaddr = saddr.sin_addr; /* Server IP address */
 
+    if (ntohs(bp->bp_flags) & RFC1531_BROADCAST_FLAG) {
+        rbp->bp_flags = htons(RFC1531_BROADCAST_FLAG);
+        daddr.sin_addr.s_addr = 0xffffffff;
+        /* XXX should use link-level address to ff:ff:ff:ff:ff:ff too */
+    }
+
     q = rbp->bp_vend;
     memcpy(q, rfc1533_cookie, 4);
     q += 4;
Index: slirp/bootp.h
===================================================================
RCS file: /sources/qemu/qemu/slirp/bootp.h,v
retrieving revision 1.2
diff -u -r1.2 bootp.h
--- slirp/bootp.h	5 Jun 2005 17:11:42 -0000	1.2
+++ slirp/bootp.h	21 Oct 2006 02:29:36 -0000
@@ -6,6 +6,8 @@
 #define BOOTP_REQUEST	1
 #define BOOTP_REPLY	2
 
+#define RFC1531_BROADCAST_FLAG  0x8000
+
 #define RFC1533_COOKIE		99, 130, 83, 99
 #define RFC1533_PAD		0
 #define RFC1533_NETMASK		1
@@ -99,7 +101,7 @@
     uint8_t bp_hops;
     uint32_t bp_xid;
     uint16_t bp_secs;
-    uint16_t unused;
+    uint16_t bp_flags;
     struct in_addr bp_ciaddr;
     struct in_addr bp_yiaddr;
     struct in_addr bp_siaddr;