The spec says:

If at any point a session ID is received that cannot a valid ID for a
client-initiated bidirectional stream, the recepient MUST close the
connection with an H3_ID_ERROR error code.If at any point a session ID is received that cannot a valid ID for a
client-initiated bidirectional stream, the recepient MUST close the
connection with an H3_ID_ERROR error code.

Our current implementation behaves as follows:
When a WebTransprot stream is received with a session id, we check if we have a session with the ID that is active. If we do not we close the steam with the HttpStreamCreation error (this code). We do not check id session ID is a valid stream ID for client-initiated streams.
An invalid session ID will not have a session registered therefore the stream will be closed. The spec foresees that the connection will be closed with an H3_ID_ERROR error.

What we need to do:

• check if the session ID is a valid client-initiated stream id. We should also check stream limits, i.e. that we do not receive an ID that is a valid valid client-initiated stream id, but it is higher than the allowed stream ID.
• for the later check use the is_stream_id_allowed function.