HSM is not handling the http requests directly. If you send an improper request data like not sending proper xml, you will see the errors from the iCloud server endpoint. The endpoint that is sending data to HSM could be patched to validate concurrent requests. Of course I may be missing something but we will never know the truth until Apple confirms it.