`882b389668067a29bb539d0f5bd5cb2f83b93012` forgets to return from `connection_exit_connect()` if `connected_cell_format_payload()` fails: https://gitweb.torproject.org/tor.git/blob/HEAD:/src/or/connection_edge.c#l2613 I'm not too familiar with the high-level logic of this code, but this looks buggy.