Summary

ISC dhclient can remain in unicast RENEW toward a DHCP server that has lost
the client session for the remainder of the lease lifetime (often many hours),
while the WAN link stays administratively and carrier UP. The interface may
still hold a previously assigned address; no DISCOVER / INIT-REBOOT is
attempted until expire.

This is distinct from T9085 (RENEW succeeds but does not reinstall a missing
kernel default). Here RENEW never successfully completes against a live server.

Why it matters

1. Multi-WAN / HA: a primary path can look "configured" (address present, dhclient running) while it cannot extend the lease or recover after ISP session loss. Failover tools that key only on "default route present" may not demote; tools that probe the path see permanent loss until expire or manual dhclient restart.

2. Production (VyOS 1.5 rolling, 2026-07-11..13): Comcast DHCPv4 on a dual-stack WAN stayed broken ~10.5 hours with IPv6 still healthy on the same interface. Root cause class: wedged unicast-RENEW; recovery was restarting dhclient@iface.

3. RFC 2131 allows waiting until T2 (REBIND) / expire; product expectation on a router is earlier recovery when the server never answers RENEW.

Reproduction (conceptual)

1. BOUND on ethN with a multi-hour lease (T1 = renew time well before expire).
2. Cause the DHCP server to drop the session without taking the link down (ISP modem session reset, server reboot that forgets leases, etc.).
3. Observe dhclient continue unicast RENEW without rewriting the ISC lease "renew" timestamp into the future.
4. Without intervention, no rediscovery until expire.

Suggested fix

Preferred (implemented in accompanying PR):

• Periodic watchdog: for each active dhclient@<iface>, parse the last record in /run/dhclient/dhclient_<iface>.leases.
• If "renew" is more than GRACE (e.g. 15m) in the past and "expire" is still in the future, systemctl restart dhclient@<iface> (cooldown e.g. 30m).
• Force INIT / INIT-REBOOT path instead of sitting on a dead unicast target.

Alternatives:

• Patch isc-dhclient to cap failed RENEW attempts then reboot state (heavier, Debian packaging).
• Document operator revive only (insufficient for unattended edges).

Environment

• VyOS 1.5 Circinus rolling
• DHCP WANs with multi-hour ISP leases
• Dual-stack interfaces where v4 can wedge independently of v6

Workaround

External health daemon restarts dhclient@ after prolonged path failure
(wan-failover revive_cmd, 15m + repeat). Does not help if path probes still
pass but lease cannot renew (rarer).

Related

• T9085 — RENEW success without reinstalling missing default (exit-hook PR)
• Do not merge the two issues: different code paths and fixes