Broadcast packets are not filtered. It's possible to cause device shutdown by sending malformed broadcast packet to UDP/39999.
vulners.com/securityvulns/securityvulns:doc:6600