In the generated function ti_ndk_config_ip_init(), an array of DHCP options is constructed on the stack. This array is referenced by a CI_SERVICE_DHCP object, also constructed on the stack. CfgAddEntry() is called to copy the DHCP object into the config database, but this is a shallow copy. Later, when this object is fetched from the database, the option array pointer is looking at random stack data. This causes invalid options to be added to the DHCP Discover and Select packets.