Properly behaving clients can't generate a begin cell with streamid 0: ``` if (test_stream_id == 0) goto again; ``` but if such a begin cell does arrive at an exit, it will still launch the stream. And since relay_lookup_conn() returns NULL if streamid is 0, so there's no way to address another cell (e.g. a relay end cell) to this stream. It opens but can never be closed. This is an issue for RELAY_COMMAND_BEGIN, RELAY_COMMAND_BEGIN_DIR, and RELAY_COMMAND_RESOLVE in particular. But we should solve it for all non-control relay cells: ``` 1 -- RELAY_BEGIN [forward] 2 -- RELAY_DATA [forward or backward] 3 -- RELAY_END [forward or backward] 4 -- RELAY_CONNECTED [backward] 11 -- RELAY_RESOLVE [forward] 12 -- RELAY_RESOLVED [backward] 13 -- RELAY_BEGIN_DIR [forward] ``` I think the resolution could be to kill the circuit for breaking protocol? Bug reported by oftc_must_be_destroyed on oftc.