Dennis's analysis seems dead-on to me.  The fix would be to have some
kind of BSD Sockets API extension that could be used to identify the
arriving interface for DHCP REQUEST packets.  Ideally, such an 
extension would be coordinated with the other *BSD kernel folks,
so it could be more widely implemented than just NetBSD.

Ran