Hook another iSCSI target before autoboot/scriptlet help?

[IAPro]

Wondering if anyone can help with the scriptlet option, and/or tell me if there's a better way to do what I'm trying to do?

I'd like to hook more than just the target specified by "root-path" as a bios drive, to install multiple operating systems for a special purpose host. Keeping operating systems on separate targets instead of in partitions on the same target would enable me to snapshot OS images separately. I confirmed something like "sanhook --drive 0x81 iscsi:192.168.4.2::::iqn.2005-01.FQDNREDACTED:Rhy01" would work using the iPXE command line. I was planning on using GRUB on the 0x80 target to choose which OS to boot.

First I saw DHCP_ISCSI_SECONDARY_TARGET_IQN which looked promising but I could find no documentation on it and it didn't appear to be anything but a define in the source code.

Then I saw the scriptlet option which should presumably allow me to execute a "sanhook" command before an autoboot, but I cannot get it to actually do anything, including simply echo a string! "Ctrl-B", then "dhcp", then "config" shows me that it is in fact there as specified in my ISC-DHCPD config. "echo ${scriptlet}" at the iPXE prompt also shows it after pulling the DHCP lease.

Scriptlet does not seem to have any documentation (http://ipxe.org/cfg/scriptlet), and there are only a handful of posts here that even mention it. The best I can determine is that it's a string if iPXE commands no longer than 255 characters, with linebreaks specified by "\".

Here are the relevant snippets from my ISC DHCPD config file. Currently testing using a VMware ESXi test VM.

Code:

option ipxe.scriptlet code 81 = string;

...

host ipxetest {
  hardware ethernet 00:50:56:3f:99:99;
  fixed-address 192.168.4.67;
  option host-name "ipxetest";
  if exists user-class and option user-class = "iPXE" {
    filename "";
    option root-path "iscsi:192.168.4.2::::iqn.2005-01.FQDNREDACTED:Rhy00";
    option ipxe.keep-san 1;
    option routers none;
    option ipxe.scriptlet "echo Scriptlet Executed";
  } else {
    filename "/iPXE/undionly.kpxe";
    option routers none;
  }
}

Although the scriptlet option content can be confirmed via "config", if I don't interrupt the boot process, it just tries to boot from the "root-path" target without executing the echo command in the scriptlet:

Code:

iPXE 1.0.0+ (f557) -- Open Source Network Boot Firmware -- http://ipxe.org
Features: DNS HTTP iSCSI TFTP AoE ELF MBOOT PXE bzImage Menu PXEXT

net0: 00:50:56:3f:99:99 using undionly on UNDI-PCI02:00.0 (open)
  [Link:up, TX:0 TXE:0 RX:0 RXE:0]
Configuring (net0 00:50:56:3f:99:99)...... ok
net0: 192.168.4.67/255.255.255.0
Root path: iscsi:192.168.4.2::::iqn.2005-01.FQDNREDACTED:Rhy00
Registered SAN device 0x80
Booting from SAN device 0x80

I'm running a freshly downloaded copy of undionly.kpxe http://boot.ipxe.org/undionly.kpxe.

Another option is obviously to use an embedded script in a copy of undionly.kpxe customized for this host that would allow me to pick which "root-path" I want via a menu, but the scriptlet option seems simpler and should work?