Z-Wave JS limits two kinds of incoming requests that could leave a network busy or unresponsive. A radio-test request must target a known device other than the controller, cannot request more than one thousand test frames, and cannot restart a test already running.
The driver also caps outstanding challenges used by the older S0 security protocol. A flood of requests could previously exhaust every challenge identifier and trap the driver in an endless search for a free one. At the new limit it refuses the additional request instead.