It is my understanding that the range extender forges the the MAC address ("Virtual MAC") of its connected clients.

When the Range Extenders forward a DHCP request to my server it replaced the MAC of the source packet with a virtual one.

My DHCP server responds with an offer that includes the virtual MAC and my end device sees it.

However it is ignored by the source device because the MAC it responded to was not replaced by the range extenders when it forwarded the offer.

One of these range extenders is not correctly reverse mapping the MAC address back to the source MAC so the network on the remote side of the extender fails.

Please give me a way to disable the Virtual MAC addressing or correct the firmware so that repeaters correctly map MACs back to the clients.

Client             -> TL-WA850RE in extender mode -> RE220 in extender mode -> Router            -> Server
AA:BB:CC:9A:76:0B  -> ????                        -> ????                   -> DE:32:3B:0F:64:5B -> DE:32:3B:0F:64:5B
Real MAC           -> ????                        -> ????                   -> No change         -> What's received

Broadcast          <- TL-WA850RE in extender mode -> RE220 in extender mode <- Router            <- Server
DA:47:32:0F:64:5B  <- ????                        <- ????                   <- DE:32:3B:0F:64:5B <- DE:32:3B:0F:64:5B
What is broadcast  <- ????                        <- ????                   <- No change         <- No Change 

The capture below was from the LAN port of the TL-WA850RE:

19:44:45.945032 AA:BB:CC:9a:76:0b > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: (tos 0x0, ttl 64, id 41889, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.68 > 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, Request from AA:BB:CC:9a:76:0b, length 300, xid 0xe40520c7, secs 377, Flags [none] (0x0000)
   Client-Ethernet-Address AA:BB:CC:9a:76:0b
   Vendor-rfc1048 Extensions
     Magic Cookie 0x63825363
     DHCP-Message (53), length 1: Discover
     Parameter-Request (55), length 14:
       Subnet-Mask (1), Classless-Static-Route (121), Default-Gateway (3), Domain-Name-Server (6)
       Hostname (12), Domain-Name (15), MTU (26), BR (28)
       Static-Route (33), Lease-Time (51), Server-ID (54), RN (58)
       RB (59), Unknown (119)
     MSZ (57), length 2: 1472
     Client-ID (61), length 19: hardware-type 255, REMOVED
     SLP-NA (80), length 0""
     Unknown (145), length 1: 1

19:44:49.382982 AA:BB:CC:08:24:f8 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 345: (tos 0xc0, ttl 64, id 7485, offset 0, flags [none], proto UDP (17), length 331)
    192.168.10.250.67 > 255.255.255.255.68: [no cksum] BOOTP/DHCP, Reply, length 303, xid 0xe40520c7, secs 377, Flags [Broadcast] (0x8000)
   Your-IP 192.168.10.164
   Server-IP 192.168.10.250
   Client-Ethernet-Address da:47:32:0f:64:5b
   Vendor-rfc1048 Extensions
     Magic Cookie 0x63825363
     DHCP-Message (53), length 1: Offer
     Server-ID (54), length 4: 192.168.10.250
     Lease-Time (51), length 4: 43200
     RN (58), length 4: 21600
     RB (59), length 4: 37800
     Subnet-Mask (1), length 4: 255.255.255.0
     BR (28), length 4: 192.168.10.255
     Domain-Name (15), length 9: "local.net"
     Domain-Name-Server (6), length 4: 192.168.10.250
     Default-Gateway (3), length 4: 192.168.10.254

This is the capture of the request and response from my DHCP server:

19:44:45.914144 de:32:3b:0f:64:5b (oui Unknown) > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x0, ttl 64, id 41889, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.86 > 255.255.255.255.67: BOOTP/DHCP, Request from de:32:3b:0f:64:5b (oui Unknown), length 300, xid 0xe40520c7, secs 377, Flags [Broadcast]
   Client-Ethernet-Address de:32:3b:0f:64:5b (oui Unknown)
   Vendor-rfc1048 Extensions
     Magic Cookie 0x63825363
     DHCP-Message Option 53, length 1: Discover
     Parameter-Request Option 55, length 14:
       Subnet-Mask, Classless-Static-Route, Default-Gateway, Domain-Name-Server
       Hostname, Domain-Name, MTU, BR
       Static-Route, Lease-Time, Server-ID, RN
       RB, Option 119
     MSZ Option 57, length 2: 1472
     Client-ID Option 61, length 19: hardware-type 255, REMOVED
     SLP-NA Option 80, length 0""
     T145 Option 145, length 1: 1

19:44:49.240620 AA:BB:CC:08:24:f8 (oui Unknown) > Broadcast, ethertype IPv4 (0x0800), length 345: (tos 0xc0, ttl 64, id 7485, offset 0, flags [none], proto UDP (17), length 331)
    192.168.10.250.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 303, xid 0xe40520c7, secs 377, Flags [Broadcast]
   Your-IP 192.168.10.164
   Server-IP 192.168.10.250
   Client-Ethernet-Address de:32:3b:0f:64:5b (oui Unknown)
   Vendor-rfc1048 Extensions
     Magic Cookie 0x63825363
     DHCP-Message Option 53, length 1: Offer
     Server-ID Option 54, length 4: 192.168.10.250
     Lease-Time Option 51, length 4: 43200
     RN Option 58, length 4: 21600
     RB Option 59, length 4: 37800
     Subnet-Mask Option 1, length 4: 255.255.255.0
     BR Option 28, length 4: 192.168.10.255
     Domain-Name Option 15, length 9: "local.net"
     Domain-Name-Server Option 6, length 4: 192.168.10.250
     Default-Gateway Option 3, length 4: 192.168.10.254