We have verified that 2811 routers running 12.4 versions of code are behaving this way:
1) An IP address is released by a client
2) The arp cache for the router still has the client's mac address
3) A new client boots up and sends a DHCPDISCOVER
4) The DHCP server (on another network, so I have ip helper-addresses on my 2811 routers) replies with a DHCPOFFER
5) The DHCPOFFER is the IP address released by the 1st client
6) The 2811 router forwards the DHCPOFFER to the mac address in the arp cache, not the DHCPDISCOVER client (this was verified with a sniffer).
Anybody else seen this? Is this a bug or a "security feature" to try to prevent duplicate IP addresses?