It makes perfect sense in hindsight, but I was nonetheless pleasantly surprised: when the router acting as a DHCP client (configured with the ip address dhcp interface configuration command) receives the DHCP reply packet containing the default gateway option (option #3), it installs a static default route toward that next-hop.
Even better, the default route is installed with the administrative distance 254 (floating static route), making sure that the default route you’ve configured manually or the default route received via a routing protocol are not overwritten.
To add icing on the cake, starting with IOS release 12.3(8)T you can disable this behavior with the no ip dhcp client request router interface-configuration command.
The following listing contains a sample debugging session documenting this behavior:
DHCP: Received a BOOTREP pkt DHCP: Scan: Message type: DHCP Ack DHCP: Scan: Server ID Option: 192.168.0.1 = C0A80001 DHCP: Scan: Lease Time: 86400 DHCP: Scan: Renewal time: 43200 DHCP: Scan: Rebind time: 75600 DHCP: Scan: Host Name: r4.company.com. DHCP: Scan: Subnet Address Option: 255.255.255.240 DHCP: Scan: Router Option: 192.168.0.1 ... deleted ... DHCP: Server ID Option: 192.168.0.1 DHCP Host Name Option: r4.company.com. DHCP: Releasing ipl options: DHCP: Applying DHCP options: Setting default_gateway to 192.168.0.1 Adding default route 192.168.0.1 Allocated IP address = 192.168.0.6 255.255.255.240 %DHCP-6-ADDRESS_ASSIGN: Interface FastEthernet0/0 assigned DHCP address 192.168.0.6, mask 255.255.255.240, hostname r4 r4#show ip route 0.0.0.0 Routing entry for 0.0.0.0 0.0.0.0, supernet Known via "static", distance 254, metric 0, candidate default path Routing Descriptor Blocks: * 192.168.0.1 Route metric is 0, traffic share count is 1