server may not send > 3 packets without validation

[mcmanus]

Servers MUST NOT send more than three Handshake packets without validation

Servers MUST NOT send more than three Handshake packets without receiving a packet from a verified source address. Source addresses can be verified through an address validation token, receipt of the final cryptographic message from the client, or by receiving a valid PATH_RESPONSE frame from the client.

If the server expects to generate more than three Handshake packets in response to an Initial packet, it SHOULD include a PATH_CHALLENGE frame in each Handshake packet that it sends. After receiving at least one valid PATH_RESPONSE frame, the server can send its remaining Handshake packets. Servers can instead perform address validation using a Retry packet; this requires less state on the server, but could involve additional computational effort depending on implementation choices.

[mcmanus]

https://github.com/quicwg/base-drafts/issues/1257

clarifies that this is 3 out per 1 in