Ok, and at what point is the client trying udp-500? I don't think the PXE-loaded REMBO would try it. Is this occurring in the Windows PE image (after an image is selected, the client boots into a WinPE in RAMDISK and uses the rbagent program to download the WIM image to the disk)? Or is this after the image has been applied to disk and the client has rebooted into Windows Setup?
What's the destination for the UDP-500 traffic? Is it the OSD server, a Domain Controller, or something else?