In the DHCP discover packet, the source IP address field is 0.0.0.0 which means the client does not have an IP address yet. But, in the DHCP offer packet, an unicast address (which will be allocated for this client) is specified as destination address. Since the client does not have an IP address at this moment, how does the packet which has an unicast address reach the client correctly ? How the client identifies that this offer packet is destined for it ? My understanding is that, the client which has no IP can only be reachable with a broadcast IP. I cannot understand how it is reachable with an unicast IP.
This is because the DHCP server must reside or have a relay/proxy on the same L2 network as the client.
The DHCP OFFER is sent to the L2 address of the client (i.e. it's MAC address). If the request was relayed/proxied, then the DHCP OFFER goes to the relay/proxy which will then forward it to the correct L2 network.
Broadcast traffic can be problematic for networks, so this reduces the amount of broadcast network that is necessary.