This is quite the head scratcher. I have installed about 7 AP's that pulled a DHCP address from a scope that (accidentally) had no DHCP option 43 associated to it.
It is my impression this should not of worked. The LWAPP firmware is 184.108.40.206
but is full of AP's that did not find the controller with out option 43.
How could this be?
LWAPP AP's discover controller thru other methods as well. DHCP Option 43 is only one of those methods.
> Pre-Configured (aka Primed) AP's will remember their previously joined controller's Mgmt IP address in NVRAM
> DHCP Option 43
> DNS entry 'CISCO-LWAPP-CONTROLLER.localdomain' lookup
> Local broadcast domain (same subnet)
> OTAP - Messages from neighboring AP's
Your AP's must have found the controller thru one of these methods.
Does this help (feel free to rate this response).