The per-source limiter keyed buckets by the full IPv6 address. One host holds a whole /64 and can mint 2^64 buckets. That host bypasses the limit and grows the entries map. The limiter now shares one bucket per /64. IPv4 keys do not change.
