Where is &quot;somewhere&quot;, the kernel only has a finite amount of memory. It&#x27;s still a denial of service, whether it occurs in the kernel, or a user-space program. The point is that in order to service legitimate clients, the initial request must be buffered somewhere.<p>For the 1rtt case, the request isn&#x27;t sent till the TLS connection has been established. The attackers would have to keep track of these TLS connections, so this doesn&#x27;t seem like a DoS vector.<p>For 0rtt the attackers might not need to keep track of state, allowing them to simply send TLS 1.3 requests, and overload the server&#x27;s memory. My question is whether this is a legitimate concern.