When a processes calls mmap on the binder fd, it specifies how much space to map. Binder refused to map more than 4Meg. If you send a message to a process and it doesn't have room in that space to store the message, you get an error back.
So the worst one process can do to another is fill up its incoming queue so that it cannot get real work done.