Privacy Sub-layer resides on the top of Physical layer in IEEE 802.16 standard, therefore, WiMAX networks are open to to physical layer attacks for example, blocking and rushing. Blocking is done by activating a source of strong noise to significantly lowering the capacity of the channel, therefore denying services (DoS) to all stations.
However, blocking or jamming is detectable with radio analyzer devices. Rushing or scrambling is another type of jamming, but it takes place for a short interval of time aimed at particular frames. Control or management messages could be jumbled, but it is not possible with delay sensitive message i.e., scrambling Uplink slots are comparatively hard, because attacker has to interpret control information and to send noise during a particular interval. (Michel Barbeau)