Correct, +4.
But you will always know the inputs.. they are part of the instantX tx that is propagated. And true, it falls back to a regular transaction but an intricate DDoS could force most/all instantX tx to become regular diminishing the great benefit that DASH offers to, say, merchants...