FWIW, I tried that DoS idea on a little digitalocean machine. It capped the number of open file descriptors for the SSH daemon at 1024. Only about 3000 file descriptors were in use after it stopped allocating channels, and file-heavy operations like apt-get still succeeded.