Replies to BOOTP packets contain data from kernel space.
vulners.com/securityvulns/securityvulns:doc:6243