In `connection_edge_process_relay_cell()`, if `conn` is `NULL` (because `!rh.stream_id` in `relay_lookup_conn()`), and the cell command is `RELAY_COMMAND_DATA`; if it gets inside: ``` if (( layer_hint && --layer_hint->deliver_window < 0) || (!layer_hint && --circ->deliver_window < 0)) { ``` it can cause a NULL pointer dereference in `connection_edge_end()`, since the check for `(!conn)` happens after that `if` statement. I suspect that this can be triggered if you spam an OR to reduce its `deliver_window` to 0, and then send a `RELAY_COMMAND_DATA` cell with no `stream_id`.