"Verizon managed" devices / IP address range

[Observer1]

o A new address allocated from the server's pool of available addresses; the address is selected based on the subnet from which the message was received (if 'giaddr' is 0) or on the address of the relay agent that forwarded the message ('giaddr' when not 0).

Assuming a new device joins the network, knows nothing about the network, and does not demand to obtain a particular IP address lease, the DHCP server on link would choose an address satisfying the 4th bullet cited above?

I interpret the "pool of available addresses" contains a limited and constrained number of addresses set by a network admin.

You interpretation appears to stem from your assumption that the DHCP specification imposes constraints on the internal organization/operation of a DHCP server, rather than how entities engaged in the DHCP dance must interact with one another.  As an example that responses aren't constrained by the mythical "pool", the third bullet states that the DHCP server may respond with the requested address, with no reference to such address falling within the "pool of available addresses".

Unless the specification explicitly defines the "the server's pool of available addresses", the reference is merely conceptual, and the definition is left up to the programmer.  E.g., if someone wanted to write a DHCP server with a pool reserved for each type of device class making DHCP requests, then that server would be responding from within one of its many defined pools of available addresses.  Obviously, that server's UI would have to allow multiple ranges to be specified.  But from the point of view of the rest of the universe, that server would be compliant with the spec because the address would be allocated from within the abstract notion of the "server's pool of available addresses" (however that server chose to define them).  I'll return to this example later.

In other words, how the server defines its "pool" is irrelevant in the broader "system" context.  It's too bad you didn't reference the paragraph in the specification soon after your quote (emphasis added):

   ...Note that, in some network architectures (e.g., internets with more
   than one IP subnet assigned to a physical network segment), it may be
   the case that the DHCP client should be assigned an address from a
   different subnet than the address recorded in 'giaddr'.  Thus, DHCP
   does not require that the client be assigned as address from the
   subnet in 'giaddr'.  A server is free to choose some other subnet,
   and it is beyond the scope of the DHCP specification to describe ways
   in which the assigned IP address might be chosen.

All along I have simply said that I was unaware of a DHCP specification requiring the address returned by a DHCP to come from within its defined "dynamic pool".

Of course, the programmer of a given DHCP server may choose to impose such a constraint.  That programmer should then document the constraint, e.g., "static addresses must be assigned within the defined dynamic address range", and the program should reject attempts by an admin to configure a static address outside the dynamic range.  And should similarly add a test to reject attempts to redefine the dynamic range if any previously defined static addresses would now fall outside said range.

Since the DHCP server code in the Verizon routers has not rejected my arbitrary static definitions over the past 15 years, and I haven't seen any documentation to support your claimed constraint, I don't believe it is impermissible to define static addresses outside of the defined dynamic range.  Even if Verizon did change its DHCP server policy and introduce such a constraint, then it would only apply to subsequently-deployed Verizon DHCP servers.

Remember my example earlier about programming a DHCP server to respond to certain requests based on device type?  Doesn't the Verizon DHCP server allocate from within its secret pool of xx.xx.100-150 when responding to STBs making DHCP requests?  According to your theory, that should not be allowed if the dynamic range can be configured with the upper limit of .99.

Finally, I refer you to the IPv4 Address Distribution web configuration page on the G3100.  You will see that the defined pool is labeled the "Dynamic IP Range".  It does not call it the "pool of available addresses".  In fact, one might reasonable argue that admins should NOT put static addresses inside a "Dynamic IP Range".  

(I'll end this reply with another reminder:  I marked this thread "Solved" at least a dozen responses ago when someone answered my question and explained that the mystery "Verizon managed devices" are STBs, and that addresses 100-150 are reserved for them, regardless of whether FIOS TV service has been provisioned or not.)

[Cang_Household]

After making an extended review of our conversation, although I still do not agree with all of your inferences made in connection to RFC 2131, I now agree with your direct interpretation of the RFC 2131.

I would not reply further on this thread, as you suggested that the solution has already been marked.