Regardless of the mode (automatic trust IP or manual inspect), SpoofGuard allows DHCP requests. However, in manual inspection mode, traffic does not pass until the DHCP-assigned IP address has been approved.
A DHCP-configured virtual machine will be assigned the private link-local address (169.254.0.0/16 for IPv4 and fe80::/64 for IPv6) when it fails to get an IP address. This link-local address is considered valid if the option of Allow local address as valid address in this namespace is set, otherwise the link-local address will be ignored.
