diff --git a/src/or/cpuworker.c b/src/or/cpuworker.c
index d5f2e45998..69811b0eba 100644
--- a/src/or/cpuworker.c
+++ b/src/or/cpuworker.c
@@ -163,13 +163,17 @@ connection_cpu_process_inbuf(connection_t *conn)
       circ = circuit_get_by_circid_orconn(circ_id, p_conn);
 
     if (success == 0) {
-      debug(LD_OR,"decoding onionskin failed. (Old key or bad sw.) Closing.");
+      debug(LD_OR,"decoding onionskin failed. (Old key or bad software.) Closing.");
       if (circ)
         circuit_mark_for_close(circ);
       goto done_processing;
     }
     if (!circ) {
-      /*XXXX Why does this happen?*/
+      /* This happens because somebody sends us a destroy cell and the
+       * circuit goes away, while the cpuworker is working. This is also
+       * why our tag doesn't include a pointer to the circ, because we'd
+       * never know if it's still valid.
+       */
       debug(LD_OR,"processed onion for a circ that's gone. Dropping.");
       goto done_processing;
     }
@@ -259,7 +263,7 @@ cpuworker_main(void *data)
     }
 
     if (read_all(fd, question, ONIONSKIN_CHALLENGE_LEN, 1) != ONIONSKIN_CHALLENGE_LEN) {
-      info(LD_BUG,"read question failed. Exiting.");
+      err(LD_BUG,"read question failed. Exiting.");
       goto end;
     }
 
diff --git a/src/or/directory.c b/src/or/directory.c
index 320485ce57..bcd1a1f13b 100644
--- a/src/or/directory.c
+++ b/src/or/directory.c
@@ -814,7 +814,7 @@ connection_dir_client_reached_eof(connection_t *conn)
                               &body, &body_len, MAX_DIR_SIZE,
                               allow_partial)) {
     case -1: /* overflow */
-      warn(LD_BUG,"'fetch' response too large (server '%s:%d'). Closing.", conn->address, conn->port);
+      warn(LD_PROTOCOL,"'fetch' response too large (server '%s:%d'). Closing.", conn->address, conn->port);
       return -1;
     case 0:
       info(LD_HTTP,"'fetch' response not all here, but we're at eof. Closing.");