``` const uint8_t *cp, *end; ... for (cp = cell->payload; cp+1 < end; ++cp) { uint16_t v = ntohs(get_uint16(cp)); ``` So we count the payload one byte at a time, considering that byte plus the one after it? ``` The payload in a VERSIONS cell is a series of big-endian two-byte integers. ``` That probably produces some weird behavior. Marking as 0.2.3 since I'm not sure yet what weird behavior. Reported by bob from irc.