Typically, if a client is trying to open a secure channel, but the device has no secure channels remaining the port is just closed. The specification does not describe this behavior? it does not describe what a client should do if it encounters this?

A device that support 2 connections, gets two valid client connections (that establish session and are using the sessions), then a third valid client connection is attempted. The client only get a closed port, so they retry, and end up trigger a DoS attack, in that they keep retrying (often). Would it not be better to check the opensecurechannel request and if valid return an error -NoSecureChannelAvailable. then the spec can describe that the client should delay (increasing delay) and re-try the connection. Even if the secure channel check is not made and the channel is just closed (which might be ok for protecting against DoS attackes) the client behavior should still be discussed in the specification.