How does intial block download work at P2P layer? A simple DOS attack while IBD could be as follows:


The fresh client is currently downloading block 100. 
Then it is offered 10 blocks at height 101, each claiming they are the heaviest chain
9 out of 10 alternatives are
    with fake PoW but still the client will waste time in getting the
    entire block and validating their PoW.


How does the current implementation of P2P protocol in bitcoin-core handle this sort of DoS attack?
Bitcoin Core does headers first sync so it downloads the headers first and partially validates them before downloading the blocks. So if a malicious node sends headers with invalid PoW's, the syncing node will disconnect from it and sync headers off of another node. If the it receives multiple headers for the same block height, that node will be considered to be misbehaving and stop syncing headers from it.