diff --git a/changes/bug28656 b/changes/bug28656
new file mode 100644
index 0000000000..d3a13d196c
--- /dev/null
+++ b/changes/bug28656
@@ -0,0 +1,3 @@
+  o Minor bugfixes (logging):
+    - Stop logging a BUG() warning when tor is waiting for exit descriptors.
+      Fixes bug 28656; bugfix on 0.3.5.1-alpha.
diff --git a/changes/bug29706_minimal b/changes/bug29706_minimal
new file mode 100644
index 0000000000..9d4a43326c
--- /dev/null
+++ b/changes/bug29706_minimal
@@ -0,0 +1,4 @@
+  o Minor bugfixes (memory management, testing):
+    - Stop leaking parts of the shared random state in the shared-random unit
+      tests. The previous fix in 29599 was incomplete.
+      Fixes bug 29706; bugfix on 0.2.9.1-alpha.
diff --git a/src/feature/dirauth/shared_random_state.c b/src/feature/dirauth/shared_random_state.c
index 2bc030f4a7..b3e4a4ef92 100644
--- a/src/feature/dirauth/shared_random_state.c
+++ b/src/feature/dirauth/shared_random_state.c
@@ -985,7 +985,7 @@ state_query(sr_state_action_t action, sr_state_object_t obj_type,
 
 /* Delete the current SRV value from the state freeing it and the value is set
  * to NULL meaning empty. */
-static void
+STATIC void
 state_del_current_srv(void)
 {
   state_query(SR_STATE_ACTION_DEL, SR_STATE_OBJ_CURSRV, NULL, NULL);
@@ -993,7 +993,7 @@ state_del_current_srv(void)
 
 /* Delete the previous SRV value from the state freeing it and the value is
  * set to NULL meaning empty. */
-static void
+STATIC void
 state_del_previous_srv(void)
 {
   state_query(SR_STATE_ACTION_DEL, SR_STATE_OBJ_PREVSRV, NULL, NULL);
diff --git a/src/feature/dirauth/shared_random_state.h b/src/feature/dirauth/shared_random_state.h
index 35626be3f6..08f999f9d4 100644
--- a/src/feature/dirauth/shared_random_state.h
+++ b/src/feature/dirauth/shared_random_state.h
@@ -140,6 +140,8 @@ STATIC int is_phase_transition(sr_phase_t next_phase);
 
 STATIC void set_sr_phase(sr_phase_t phase);
 STATIC sr_state_t *get_sr_state(void);
+STATIC void state_del_previous_srv(void);
+STATIC void state_del_current_srv(void);
 
 #endif /* defined(TOR_UNIT_TESTS) */
 
diff --git a/src/feature/nodelist/nodelist.c b/src/feature/nodelist/nodelist.c
index 935ac78403..99d7f746a8 100644
--- a/src/feature/nodelist/nodelist.c
+++ b/src/feature/nodelist/nodelist.c
@@ -2449,12 +2449,18 @@ compute_frac_paths_available(const networkstatus_t *consensus,
       f_exit = f_myexit;
   }
 
-  /* if the consensus has no exits, we can only build onion service paths,
-   * which are G - M - M. So use the middle fraction for the exit fraction. */
+  /* If the consensus has no exits that pass flag, descriptor, and policy
+   * checks, we can only build onion service paths, which are G - M - M. */
   if (router_have_consensus_path() != CONSENSUS_PATH_EXIT) {
-    /* If there are no exits in the consensus, then f_exit is always 0, so
-     * it is safe to replace f_exit with f_mid. */
-    if (!BUG(f_exit > 0.0)) {
+    /* If the exit bandwidth weight fraction is not zero, we need to wait for
+     * descriptors for those exits. (The bandwidth weight fraction does not
+     * check for descriptors.)
+     * If the exit bandwidth fraction is zero, there are no exits in the
+     * consensus at all. So it is safe to replace f_exit with f_mid.
+     *
+     * f_exit is non-negative, but some compilers complain about float and ==
+     */
+    if (f_exit <= 0.0) {
       f_exit = f_mid;
     }
   }
diff --git a/src/test/test_shared_random.c b/src/test/test_shared_random.c
index 1fb3179840..b4fe6eef64 100644
--- a/src/test/test_shared_random.c
+++ b/src/test/test_shared_random.c
@@ -74,6 +74,9 @@ init_authority_state(void)
    * the phase we are currently in which uses "now" as the starting
    * timestamp. Delete it before we do any testing below. */
   sr_state_delete_commits();
+  /* It's also possible that a current SRV has been generated, if we are at
+   * state transition time. But let's just forget about that SRV. */
+  sr_state_clean_srvs();
 
  done:
   UNMOCK(get_my_v3_authority_cert);
@@ -588,12 +591,20 @@ test_encoding(void *arg)
   ;
 }
 
-/** Setup some SRVs in our SR state. If <b>also_current</b> is set, then set
- *  both current and previous SRVs.
- *  Helper of test_vote() and test_sr_compute_srv(). */
+/** Setup some SRVs in our SR state.
+ *  If <b>also_current</b> is set, then set both current and previous SRVs.
+ *  Otherwise, just set the previous SRV. (And clear the current SRV.)
+ *
+ * You must call sr_state_free_all() to free the state at the end of each test
+ * function (on pass or fail). */
 static void
 test_sr_setup_srv(int also_current)
 {
+  /* Clear both SRVs before starting.
+   * In 0.3.5 and earlier, sr_state_set_previous_srv() and
+   * sr_state_set_current_srv() do not free() the old srvs. */
+  sr_state_clean_srvs();
+
   sr_srv_t *srv = tor_malloc_zero(sizeof(sr_srv_t));
   srv->num_reveals = 42;
   memcpy(srv->value,