While I appreciate this thread is an old one I just wanted to add some insights into DHCP and broadcast.
DHCP messages are only broadcast during the INIT and REBIND state. If the client is on the same subnet as the server it is only the DHCP DISCOVER and REQUEST messages that are broadcast from the client to the DHCP server.
While it’s true that the Client has no layer 3 address until the DHCP ACK is received the DHCP OFFER and ACK are both sent unicast, the client passes it’s MAC (layer 2) address as part of the DHCP DISCOVER message so the server knows which device it is sending the message back to when it sends the offer and it also uses the layer 3 address it is offering as the destination address.
When the time comes to try and renew the lease at time T1 the client unucasts it’s DHCP REQUEST to the server that allocated it’s address, it only switches to broadcast if it does not get a response to that at time T2.
Raven68