how to defend against DOS caused by SYN cookies?
Computing syncookies requires taking a hash of the server and client's IPs and ports... These hashes may not be inexpensive esp if they are to be cryptographically secure. One way to DOS the syncookie code is to make so many requests that the CPU of the server is exhausted.  I believe that Linux uses a less expensive (and not cryptographically secure) hash function, so this is less of an issue.

You could probably also spoof sender IP and use syncookies to be sent to a victim. But that is not that useful/ interesting.