As you can see in hs_descriptor.c ``` /* Find the start of signature. */ sig_start = tor_memstr(encoded_desc, encoded_len, "\n" str_signature); /* Getting here means the token parsing worked for the signature so if we * can't find the start of the signature, we have a code flow issue. */ if (BUG(!sig_start)) { goto err; } ``` str_signature is "signature", so, if you send the "\n signature" (like in the attachment) instead of "\nsignature" tor_memstr will return null and violate `BUG(!sig_start)` I suggest that we should just remove BUG and let it be `if (!sig_start) {`