diff --git a/ChangeLog b/ChangeLog
index 8cd4cc0624..7a630928ab 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -13,6 +13,8 @@ Changes in version 0.2.1.1-alpha - 2008-??-??
       Fixes the other part of bug 617.  Bugfix on 0.2.0.1-alpha.
     - Initialize log mutex before initializing dmalloc.  Otherwise,
       running with dmalloc would crash. Bugfix on 0.2.0.x-alpha.
+    - Keep address policies from leaking: start their refcount at 1, not
+      2. Bugfix on 0.2.0.16-alpha.
 
   o Minor features:
     - Allow separate log levels to be configured for different logging
diff --git a/src/or/policies.c b/src/or/policies.c
index cccc72acbb..31b7917e9c 100644
--- a/src/or/policies.c
+++ b/src/or/policies.c
@@ -495,7 +495,7 @@ addr_policy_get_canonical_entry(addr_policy_t *e)
     found = tor_malloc_zero(sizeof(policy_map_ent_t));
     found->policy = tor_memdup(e, sizeof(addr_policy_t));
     found->policy->is_canonical = 1;
-    found->policy->refcnt = 1;
+    found->policy->refcnt = 0;
     HT_INSERT(policy_map, &policy_root, found);
   }
 
diff --git a/src/or/routerparse.c b/src/or/routerparse.c
index 9bbeb66c37..7ff6c63112 100644
--- a/src/or/routerparse.c
+++ b/src/or/routerparse.c
@@ -1652,18 +1652,20 @@ authority_cert_parse_from_string(const char *s, const char **end_of_string)
     *end_of_string = eat_whitespace(eos);
   }
   SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_free(t));
-  if (area)
-    memarea_drop_all(area);
   smartlist_free(tokens);
-  return cert;
- err:
-  authority_cert_free(cert);
-  SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_free(t));
   if (area) {
     DUMP_AREA(area, "authority cert");
     memarea_drop_all(area);
   }
+  return cert;
+ err:
+  authority_cert_free(cert);
+  SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_free(t));
   smartlist_free(tokens);
+  if (area) {
+    DUMP_AREA(area, "authority cert");
+    memarea_drop_all(area);
+  }
   return NULL;
 }