Blocking rogue DHCP in network

If you have multiple DHCP advertisers on the same network that really is an administrator task, but here's a potential direction without that support.

MAC filtering in Windows 7 is a service provided to third-party vendors via the Windows Filtering Platform (marketing link, technology link). Though I was able to confirm Windows 7 probably supports filter by MAC, it's remarkably difficult to find anything more advanced that doesn't quickly become coding.

The solution by MAC (other than abandoning DHCP) seems to be in downloading any of the common third-party HIPS products that provide their own firewalls (which will then leverage the WFP to do what you want).

Blocking by subnet mask doesn't work because host configuration broadcast occurs over ARP to the broadcast MAC address. Responding systems direct replies back to your MAC address, and the first one your system receives will result in autoconfiguration. By the time you have an IP address sufficient to block a subnet it's too late¹

¹ To create a subnet scope for another reason, which is only effective once you have your proper configuration: screenshot in this thread. In that post they're creating an Inbound Rule, selecting the Scope tab, entering a subnet/mask and configuring access.