The client and the DHCP server exchange four messages (Discover, Offer, Request and Acknowledge) before reaching agreement on leasing a certain IP address for a certain time. On the other hand, the attack consists of spoofing DHCP Discover packets with forged MAC addresses. The server would then offer an IP address/a range of IP addresses to the client and awaits for a request.
My understanding of this process says that although the server suggests an IP address, it does not allocate it for the client until sending him the Acknowledgement message. Therefore there will be no exhaustion of DHCP IP addresses due to those forged Discover messages. Thus, the attack does not make sense for me. Could anyone please clarify this to me?