What is missing from the dhcp option 43 response ? is the same incomplete response going to other servers on the same network that can pxe boot successfully ?
After Citrix support clarified further they are expecting to see the bootp filename option in the same packet as the Option 43 info.
From Wireshark it looks like the Blade PXE service initially sends a DHCP ACK that has only the option43 info and the Xen pxe client seems to give up if it gets an ACK that has Option 43 defined but no bootp file name in the bootp header. On other clients where PXE booting works it appears their PXE clients send a second Request after that initial ACK and then get a second ACK that does include the bootp header info.
Is xen not using the standard syslinux boot image ?