What flaws in TCP make it vulnerable to DDOS?
TCP is not vulnerable to DDOS per se except via resource exhaustion (and "lack of infinite resources" is unavoidable, so not really a flaw). TCP is often used as a method of DDOS, simply by inputting more traffic into the system than it can handle.
But TCP is to DDOS as the road is to a bank robber - the fact that they jump in their car and drive off after the robbery does not make the road vulnerable or flawed.
It's important to remember that the operative word in DDOS is "Service". Only when a Service is being offered can the be used, and then over-used, in order to Deny Service. The Service has to be available, so the tools used to make it available (like TCP) are necessary and not flaws or vulnerabilities.
So the "flaw" in TCP is - it allows access to the Service. And a DDOS is just more attempts to use the Service than the network and hosts involved can handle. Not a flaw, just overuse.