Q:

What are the cons of dhcp snooping, dynamic arp inspection and ip guard?

I read about a couple of layer 2 protections against dhcp starving, mac and ip spoofing- ip guard, dhcp snooping and dynamic arp inspection.
Are there any cons or vulnerabilies which enable bypassing them or are they safe to use? 
I have noticed that each record in the dhcp binding table has a time to live and the table itself has a limited size, but I dont see how can it help the attack.

A:

TL;DR - They are safe to use, but, it depends in the configuration and implementation of your solution (as you noted - the dhcp binding table could become a problem, since IP source guard and ARP Inspection are relying on it).
DHCP Snooping with ARP Inspection
ARP Inspection and DHCP Snooping are great combination together ("supercouple").
As long as you whitelist the trusted ports in your switch, use ARP Inspection (that will prevent MAC spoofing) and correct static DHCP binding table, you will be pretty safe.
Why is that?

ARP Inspection will keep that no one could spoof his MAC
DHCP binding table - the ARP Inspection uses the DHCP binding table, by validating the MAC and the
Whitelist the trusted ports will keep the devices under the switch safe from other machines that are trying to pretend as DHCP servers 

DHCP binding table and IP Source Guard
Just as with the ARP Inspection, also this solution relies on the DHCP binding table.
General Tips

If you have a lot of "temp" users in the network, use a short lease in your binding table (as you have mentioned, the table is limited)
In order to use ARPI or IP Guard, you have to activate the DHCP snooping (and in general, use all three of them together).

