It looks like guard discovery was one component of the attack, and DoS could have been used to boot HSes into choosing a malicious guard, or at least, a raided

It looks like guard discovery was one component of the attack, and DoS could have been used to boot HSes into choosing a malicious guard, or at least, a raided (but no logs?) or somehow-rooted guard. So it's probably just a badly-coded script-kiddie-grade DoS script. It doesn't have to be an amazing, novel DoS to have an effect - it just has to be a DoS, and they don't have to show their hands by using anything particularly amazing. What I think is that they probably don't have anything that we don't know about already as being theoretically possible. They just tried every attack we do know about at once, and some of it proved fruitful given their reach. Tor stinks - but it still works, and we can improve it.