HS clients don't validate descriptor-id returned by HSDir
The rend descriptor cache for clients uses the permanent hostname as a key, instead of the descriptor-id (changed every 24 hours). When a descriptor is returned from a HSDir, the response is kept if the permanent hostname matches. The descriptor-id is not compared to the original request.
switch (rend_cache_store_v2_desc_as_client(body, conn->rend_data)) {
...
rend_client_desc_trynow(conn->rend_data->onion_address);
HS descriptors are currently valid for 3 days (legacy/trac#13207 (moved)). A HSDir could fetch and serve a days-old descriptor for the same service, and that response will be used by clients.
There is no denial of service; the client will fetch from another directory after all introductions fail. The worst effect I can see is that a HSDir could briefly distract clients by serving a very old descriptor.