diff --git a/router/java/src/net/i2p/router/tunnel/pool/BuildHandler.java b/router/java/src/net/i2p/router/tunnel/pool/BuildHandler.java
index ee98bc454..0ac378d9d 100644
--- a/router/java/src/net/i2p/router/tunnel/pool/BuildHandler.java
+++ b/router/java/src/net/i2p/router/tunnel/pool/BuildHandler.java
@@ -224,6 +224,10 @@ class BuildHandler {
             for (int i = 0; i < cfg.getLength(); i++) {
                 Hash peer = cfg.getPeer(i);
                 int record = order.indexOf(new Integer(i));
+                if (record < 0) {
+                    _log.error("Bad status index " + i);
+                    return;
+                }
                 int howBad = statuses[record];
                 if (_log.shouldLog(Log.INFO))
                     _log.info(msg.getUniqueId() + ": Peer " + peer.toBase64() + " replied with status " + howBad);
diff --git a/router/java/src/net/i2p/router/tunnel/pool/TunnelPeerSelector.java b/router/java/src/net/i2p/router/tunnel/pool/TunnelPeerSelector.java
index 565ac02ff..78a44beb5 100644
--- a/router/java/src/net/i2p/router/tunnel/pool/TunnelPeerSelector.java
+++ b/router/java/src/net/i2p/router/tunnel/pool/TunnelPeerSelector.java
@@ -43,9 +43,11 @@ public abstract class TunnelPeerSelector {
                 else
                     length -= off;
             }
-            if (length < 0)
-                length = 0;
         }
+        if (length < 0)
+            length = 0;
+        if (length > 8) // as documented in tunnel.html
+            length = 8;
         /*
         if ( (ctx.tunnelManager().getOutboundTunnelCount() <= 0) || 
              (ctx.tunnelManager().getFreeTunnelCount() <= 0) ) {