diff --git a/router/java/src/net/i2p/router/tunnel/pool/BuildHandler.java b/router/java/src/net/i2p/router/tunnel/pool/BuildHandler.java
index ee98bc4541368c29d4cb0fb02aa4e8acdf023b7a..0ac378d9d19c0518a27b4d5aded35d655617abb6 100644
--- a/router/java/src/net/i2p/router/tunnel/pool/BuildHandler.java
+++ b/router/java/src/net/i2p/router/tunnel/pool/BuildHandler.java
@@ -224,6 +224,10 @@ class BuildHandler {
             for (int i = 0; i < cfg.getLength(); i++) {
                 Hash peer = cfg.getPeer(i);
                 int record = order.indexOf(new Integer(i));
+                if (record < 0) {
+                    _log.error("Bad status index " + i);
+                    return;
+                }
                 int howBad = statuses[record];
                 if (_log.shouldLog(Log.INFO))
                     _log.info(msg.getUniqueId() + ": Peer " + peer.toBase64() + " replied with status " + howBad);
diff --git a/router/java/src/net/i2p/router/tunnel/pool/TunnelPeerSelector.java b/router/java/src/net/i2p/router/tunnel/pool/TunnelPeerSelector.java
index 565ac02ff2591e7e0024cb6b31261507f941fbbc..78a44beb59dd37e3b0a4864b9dc3ffed81cd28c8 100644
--- a/router/java/src/net/i2p/router/tunnel/pool/TunnelPeerSelector.java
+++ b/router/java/src/net/i2p/router/tunnel/pool/TunnelPeerSelector.java
@@ -43,9 +43,11 @@ public abstract class TunnelPeerSelector {
                 else
                     length -= off;
             }
-            if (length < 0)
-                length = 0;
         }
+        if (length < 0)
+            length = 0;
+        if (length > 8) // as documented in tunnel.html
+            length = 8;
         /*
         if ( (ctx.tunnelManager().getOutboundTunnelCount() <= 0) || 
              (ctx.tunnelManager().getFreeTunnelCount() <= 0) ) {