I did some more research, ran a few experiments, and even looked at the code.

What I described above is not possible. The limit_conn method fires exactly once for a connection, even if it goes to a "@retry" location. If you have several internal redirects ( rewrite /foo /bar last; ) only the last limit_conn is fired.