BIND: precondition DAV:locked-update-allowed

What return code should a BIND request return, if the precondition
DAV:locked-update-allowed is violated, i.e. the collection identified by the
request-URI is write-locked, but no appropriate token has been specified in
an If request header?

1) 409 "Conflict" with <D:error><D:locked-update-allowed/></error> in the
response-body

2) 423 "Locked"

3) 423 "Locked" with <D:error><D:locked-update-allowed/></error> in the
response-body

My feeling is that 2) would be correct.

Thanks,
Peter