SYN cookies answer when the queue overflows
A listening socket keeps two queues, not one. Half-open connections live in the SYN queue until the final ACK arrives; established ones then wait in the accept queue until the application calls accept(). Both have a limit, and which one overflows decides what the client experiences. ...