The codes have a small number in front; these are the requests. So if the server did allow 65k requests, each one would be a different number. You can guess onc

The codes have a small number in front; these are the requests. So if the server did allow 65k requests, each one would be a different number. You can guess once per request. Yes, an attacker can denial-of-service by guessing once on all the (possible) requests. There is some work towards stopping this sort of behavior (see e.g. https://github.com/warner/magic-wormhole/issues/126 https://github.com/warner/magic-wormhole/issues/126)