FWIW, here is the packet capture from the device sending out the UPnP request:
tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 262144 bytes
18:43:53.076757 IP (tos 0x0, ttl 2, id 5906, offset 0, flags [none], proto UDP (17), length 165
)
172.23.10.15.27055 >...