conflux.c:559: conflux_pick_first_leg: Assertion ((cfx->legs)->num_used) > 0 failed; aborting

Summary

Multiple tor exit relays crashed with conflux_pick_first_leg: Assertion

Steps to reproduce:

We do not have a reproducer.

What is the current bug behavior?

tor_assertion_failed_(): Bug: ../src/core/or/conflux.c:559: conflux_pick_first_leg: Assertion ((cfx->legs)->num_used) > 0 failed; aborting. (on Tor 0.4.8.2-alpha-dev )
Bug: Tor 0.4.8.2-alpha-dev: Assertion ((cfx->legs)->num_used) > 0 failed in conflux_pick_first_leg at ../src/core/or/conflux.c:559: . Stack trace: (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(log_backtrace_impl+0x57) [0x55fda8a2aad7] (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(tor_assertion_failed_+0x148) [0x55fda8a35a88] (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(conflux_decide_next_circ+0x3e4) [0x55fda8ac62d4] (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(circuit_get_package_window+0x3e) [0x55fda8acbcae] (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(+0x95037) [0x55fda89d5037] (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(connection_edge_package_raw_inbuf+0xa1) [0x55fda89d7011] (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(connection_edge_process_inbuf+0x67) [0x55fda8ae3157] (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(+0x19b8da) [0x55fda8adb8da] (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(+0x6f3e9) [0x55fda89af3e9] (on Tor 0.4.8.2-alpha-dev )
Bug:     /lib/x86_64-linux-gnu/libevent-2.1.so.7(+0x23b4f) [0x7f9228024b4f] (on Tor 0.4.8.2-alpha-dev )
Bug:     /lib/x86_64-linux-gnu/libevent-2.1.so.7(event_base_loop+0x52f) [0x7f922802528f] (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(do_main_loop+0x101) [0x55fda89b06e1] (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(tor_run_main+0x1e5) [0x55fda89abf95] (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(tor_main+0x49) [0x55fda89a82d9] (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(main+0x19) [0x55fda89a7eb9] (on Tor 0.4.8.2-alpha-dev )
Bug:     /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xea) [0x7f92278bfd0a] (on Tor 0.4.8.2-alpha-dev )
Bug:     /usr/bin/tor(_start+0x2a) [0x55fda89a7f0a] (on Tor 0.4.8.2-alpha-dev )
We compiled with OpenSSL 101010ef: OpenSSL 1.1.1n  15 Mar 2022 and we are running with OpenSSL 101010ef: 1.1.1n. These two versions should be binary compatible.
Tor 0.4.8.2-alpha-dev running on Linux with Libevent 2.1.12-stable, OpenSSL 1.1.1n, Zlib 1.2.11, Liblzma 5.2.5, Libzstd 1.4.8 and Glibc 2.31 as libc.

What is the expected behavior?

no crashes

Environment

debian package: 0.4.8.2-alpha-dev-20230723T020414Z-1~bpo11+1

Debian 11