diff --git a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPClient.java b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPClient.java
index b42376dbf72132ba0a8515af8326b5a2b217a87f..8e5ef9f4dc560b7fa19ed4f52ec29b0ccd263c90 100644
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPClient.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPClient.java
@@ -185,7 +185,7 @@ public class I2PTunnelHTTPClient extends I2PTunnelClientBase implements Runnable
     
     /** 
      * create the default options (using the default timeout, etc)
-     *
+     * unused?
      */
     protected I2PSocketOptions getDefaultOptions() {
         Properties defaultOpts = getTunnel().getClientOptions();
@@ -210,6 +210,9 @@ public class I2PTunnelHTTPClient extends I2PTunnelClientBase implements Runnable
             defaultOpts.setProperty(I2PSocketOptions.PROP_READ_TIMEOUT, ""+DEFAULT_READ_TIMEOUT);
         if (!defaultOpts.contains("i2p.streaming.inactivityTimeout"))
             defaultOpts.setProperty("i2p.streaming.inactivityTimeout", ""+DEFAULT_READ_TIMEOUT);
+        // delayed start
+        if (sockMgr == null)
+            sockMgr = getSocketManager();
         I2PSocketOptions opts = sockMgr.buildOptions(defaultOpts);
         if (!defaultOpts.containsKey(I2PSocketOptions.PROP_CONNECT_TIMEOUT))
             opts.setConnectTimeout(DEFAULT_CONNECT_TIMEOUT);
diff --git a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java
index 536844af9cbd022bb34fa44d7f8462be4bd030f1..d6cb40a25913f306a8e4d60e5dba496dcbe15b10 100644
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java
@@ -171,7 +171,24 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer {
                 sender.start();
                 
                 browserout = _browser.getOutputStream();
-                serverin = _webserver.getInputStream(); 
+                // NPE seen here in 0.7-7, caused by addition of socket.close() in the
+                // catch (IOException ioe) block above in blockingHandle() ???
+                // CRIT  [ad-130280.hc] net.i2p.util.I2PThread        : Killing thread Thread-130280.hc
+                // java.lang.NullPointerException
+                //     at java.io.FileInputStream.<init>(FileInputStream.java:131)
+                //     at java.net.SocketInputStream.<init>(SocketInputStream.java:44)
+                //     at java.net.PlainSocketImpl.getInputStream(PlainSocketImpl.java:401)
+                //     at java.net.Socket$2.run(Socket.java:779)
+                //     at java.security.AccessController.doPrivileged(Native Method)
+                //     at java.net.Socket.getInputStream(Socket.java:776)
+                //     at net.i2p.i2ptunnel.I2PTunnelHTTPServer$CompressedRequestor.run(I2PTunnelHTTPServer.java:174)
+                //     at java.lang.Thread.run(Thread.java:619)
+                //     at net.i2p.util.I2PThread.run(I2PThread.java:71)
+                try {
+                    serverin = _webserver.getInputStream(); 
+                } catch (NullPointerException npe) {
+                    throw new IOException("getInputStream NPE");
+                }
                 CompressedResponseOutputStream compressedOut = new CompressedResponseOutputStream(browserout);
                 Sender s = new Sender(compressedOut, serverin, "server: server to browser");
                 if (_log.shouldLog(Log.INFO))
diff --git a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKS4aServer.java b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKS4aServer.java
index 2745cb0fa9f7dcf73bc9e60e350f2cd18be14e84..23ec70c3fd1d19a61a0df0aa5f56b830d800a823 100644
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKS4aServer.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKS4aServer.java
@@ -198,7 +198,8 @@ public class SOCKS4aServer extends SOCKSServer {
         I2PSocket destSock;
 
         try {
-            if (connHostName.toLowerCase().endsWith(".i2p")) {
+            if (connHostName.toLowerCase().endsWith(".i2p") ||
+                connHostName.toLowerCase().endsWith(".onion")) {
                 _log.debug("connecting to " + connHostName + "...");
                 // Let's not due a new Dest for every request, huh?
                 //I2PSocketManager sm = I2PSocketManagerFactory.createManager();
@@ -224,7 +225,7 @@ public class SOCKS4aServer extends SOCKSServer {
             } else {
                 List<String> proxies = t.getProxies(connPort);
                 if (proxies == null || proxies.size() <= 0) {
-                    String err = "No outproxy configured for port " + connPort + " and no default configured either";
+                    String err = "No outproxy configured for port " + connPort + " and no default configured either - host: " + connHostName;
                     _log.error(err);
                     try {
                         sendRequestReply(Reply.CONNECTION_REFUSED, InetAddress.getByName("127.0.0.1"), 0, out);
diff --git a/apps/i2ptunnel/jsp/editClient.jsp b/apps/i2ptunnel/jsp/editClient.jsp
index d20c9f58dc157788928a2f4c13c65173b1ca1568..6dd839d9795d61c0b1620c1631b860a8ebcfe9d7 100644
--- a/apps/i2ptunnel/jsp/editClient.jsp
+++ b/apps/i2ptunnel/jsp/editClient.jsp
@@ -307,7 +307,7 @@
             </div>
             <div id="portField" class="rowItem">
                 <label for="reduceTime" accesskey="d">
-                    Reduce when idle (minutes):
+                    Idle minutes:
                 </label>
                 <input type="text" id="port" name="reduceTime" size="4" maxlength="4" title="Reduced Tunnel Idle Time" value="<%=editBean.getReduceTime(curTunnel)%>" class="freetext" />                
             </div>
@@ -329,7 +329,7 @@
             </div>
             <div id="portField" class="rowItem">
                 <label for="access" accesskey="c">
-                    Generate New Destination Keys On Reopen:
+                    New Keys on Reopen:
                 </label>
                 <table border="0"><tr><!-- I give up -->
                 <td><input value="1" type="radio" id="startOnLoad" name="newDest" title="New Destination"
@@ -342,7 +342,7 @@
             </div>
             <div id="portField" class="rowItem">
                 <label for="reduceTime" accesskey="c">
-                    Close when idle (minutes):
+                    Idle minutes:
                 </label>
                 <input type="text" id="port" name="closeTime" size="4" maxlength="4" title="Close Tunnel Idle Time" value="<%=editBean.getCloseTime(curTunnel)%>" class="freetext" />                
             </div>
diff --git a/apps/i2ptunnel/jsp/editServer.jsp b/apps/i2ptunnel/jsp/editServer.jsp
index eb407ec16c02a4cced23683c37d18cb7d063a21d..b3917cced2e48fb5f6255bef565e04b52382c667 100644
--- a/apps/i2ptunnel/jsp/editServer.jsp
+++ b/apps/i2ptunnel/jsp/editServer.jsp
@@ -326,7 +326,7 @@
             </div>
             <div id="portField" class="rowItem">
                 <label for="reduceTime" accesskey="d">
-                    Reduce when idle (minutes):
+                    Idle minutes:
                 </label>
                 <input type="text" id="port" name="reduceTime" size="4" maxlength="4" title="Reduced Tunnel Idle Time" value="<%=editBean.getReduceTime(curTunnel)%>" class="freetext" />                
             </div>
@@ -354,7 +354,7 @@
             </div>
             <div id="portField" class="rowItem">
                 <label for="force" accesskey="c">
-                    Estimate Hashcash Calc Time:
+                    Hashcash Calc Time:
                 </label>
                 <button id="controlSave" accesskey="S" class="control" type="submit" name="action" value="Estimate" title="Estimate Calculation Time">Estimate</button>
             </div>
diff --git a/apps/routerconsole/jsp/help.jsp b/apps/routerconsole/jsp/help.jsp
index d53f93a885bffc821dd7bf1dbc3a30011a9f0a49..279df95ddf07edb85d6e3ec090f4583891e8f6b3 100644
--- a/apps/routerconsole/jsp/help.jsp
+++ b/apps/routerconsole/jsp/help.jsp
@@ -12,12 +12,126 @@
 
 <div class="main" id="main">
 <h2>Help</h2>
-Sorry, there's no help text here yet, so check out the
+Sorry, there's not much help text here yet, so also check out the
 <a href="http://www.i2p2.i2p/faq.html">FAQ on www.i2p2.i2p</a>
 or the
 <a href="http://www.i2p2.i2p/faq_de.html">Deutsch FAQ</a>.
+You may also try the
+<a href="http://forum.i2p/">forum</a>
+or IRC.
 <br />
 
+<h2>Summary Bar Information</h2>
+<h3>General</h3>
+<ul>
+<li><b>Ident:</b>
+The first four characters (24 bits) of your 44-character (256-bit) Base64 router hash.
+The full hash is shown on your <a href="netdb.jsp?r=.">router info page</a>.
+Never reveal this to anyone, as your router info contains your IP.
+<li><b>Version:</b>
+The version of the I2P software you are running.
+<li><b>Now:</b>
+The current time (UTC) and the skew, if any. I2P requires your computer's time be accurate.
+If the skew is more than a few seconds, please correct the problem by adjusting
+your computer's time.
+<li><b>Reachability:</b>
+The router's view of whether it can be contacted by other routers.
+Further information is on the <a href="config.jsp#help">configuration page</a>.
+</ul>
+
+<h3>Peers</h3>
+<ul>
+<li><b>Active:</b>
+The first number is the number of peers you've sent or received a message from in the last few minutes.
+This may range from 8-10 to several hundred, depending on your total bandwidth,
+shared bandwidth, and locally-generated traffic.
+The second number is the number of peers seen in the last hour or so.
+Do not be concerned if these numbers vary widely.
+<li><b>Fast:</b>
+This is the number of peers you use for building client tunnels. It is generally in the
+range 8-15. Your fast peers are shown on the <a href="profiles.jsp">profiles page</a>.
+<li><b>High Capacity:</b>
+This is the number of peers you use for building some of your exploratory tunnels. It is generally in the
+range 8-25. The fast peers are included in the high capacity tier.
+Your high capacity peers are shown on the <a href="profiles.jsp">profiles page</a>.
+<li><b>Well Integrated:</b>
+This is the number of peers you use for network database inquiries.
+These are usually the "floodfill" peers.
+Your well integrated peers are shown on the bottom of the <a href="profiles.jsp">profiles page</a>.
+<li><b>Known:</b>
+This is the total number of routers you know about.
+They are listed on the <a href="netdb.jsp">network database page</a>.
+This may range from under 100 to 1000 or more.
+This number is not the total size of the network;
+it may vary widely depending on your total bandwidth,
+shared bandwidth, and locally-generated traffic.
+I2P does not require a router to know every other router.
+</ul>
+
+<h3>Bandwidth in/out</h3>
+Should be self-explanatory. All values are in bytes per second, not bits per second.
+Change your bandwidth limits on the <a href="config.jsp#help">configuration page</a>.
+
+<h3>Local destinations</h3>
+The local applications connecting through your router.
+These may be clients started through <a href="i2ptunnel/index.jsp">I2PTunnel</a>
+or external programs connecting through SAM, BOB, or directly to I2CP.
+
+<h3>Tunnels in/out</h3>
+The actual tunnels are shown on the <a href="tunnels.jsp">the tunnels page</a>.
+<ul>
+<li><b>Exploratory:</b>
+Tunnels built by your router and used for communication with the floodfill peers,
+building new tunnels, and testing existing tunnels.
+<li><b>Client:</b>
+Tunnels built by your router for each client's use.
+<li><b>Participating:</b>
+Tunnels built by other routers through your router.
+This may vary widely depending on network demand, your
+shared bandwidth, and amount of locally-generated traffic.
+The recommended method for limiting participating tunnels is
+to change your share percentage on the <a href="config.jsp#help">configuration page</a>.
+You may also limit the total number by setting <tt>router.maxParticipatingTunnels=nnn</tt> on
+the <a href="configadvanced.jsp">advanced configuration page</a>.
+</ul>
+
+<h3>Congestion</h3>
+Some basic indications of router overload.
+<li><b>Job lag:</b>
+How long jobs are waiting before execution. The job queue is listed on the <a href="jobs.jsp">jobs page</a>.
+Unfortunately, there are several other job queues in the router that may be congested,
+and their status is not available in the router console.
+The job lag should generally be zero.
+If it is consistently higher than 500ms, your computer is very slow, or the
+router has serious problems.
+<li><b>Message delay:</b>
+How long an outbound message waits in the queue.
+This should generally be a few hundred milliseconds or less.
+If it is consistently higher than 1000ms, your computer is very slow,
+or you should adjust your bandwidth limits, or your (bittorrent?) clients
+may be sending too much data and should have their transmit bandwidth limit reduced.
+<li><b>Tunnel lag:</b>
+This is the round trip time for a tunnel test, which sends a single message
+out a client tunnel and in an exploratory tunnel, or vice versa.
+It should usually be less than 5 seconds.
+If it is consistently higher than that, your computer is very slow,
+or you should adjust your bandwidth limits, or there are network problems.
+<li><b>Handle backlog:</b>
+This is the number of pending requests from other routers to build a
+participating tunnel through your router.
+It should usually be close to zero.
+If it is consistently high, your computer is too slow,
+and you should reduce your share bandwidth limits.
+<li><b>Accepting/Rejecting:</b>
+Your routers' status on accepting or rejecting
+requests from other routers to build a
+participating tunnel through your router.
+Your router may accept all requests, accept or reject a percentage of requests,
+or reject all requests for a number of reasons, to control
+the bandwidth and CPU demands and maintain capacity for
+local clients.
+</ul>
+
 <h2>Legal stuff</h2>
 The I2P router (router.jar) and SDK (i2p.jar) are almost entirely public domain, with 
 a few notable exceptions:<ul>
diff --git a/router/java/src/net/i2p/router/tunnel/FragmentHandler.java b/router/java/src/net/i2p/router/tunnel/FragmentHandler.java
index 5a97956b9aee0bb8d5825eefdcfc6f7891bd711f..dbe256ebd513bdbe1864c510cfa1b3f3e9613ef8 100644
--- a/router/java/src/net/i2p/router/tunnel/FragmentHandler.java
+++ b/router/java/src/net/i2p/router/tunnel/FragmentHandler.java
@@ -74,6 +74,12 @@ public class FragmentHandler {
         int padding = 0;
         while (preprocessed[offset] != (byte)0x00) {
             offset++; // skip the padding
+            // AIOOBE http://forum.i2p/viewtopic.php?t=3187
+            if (offset >= TrivialPreprocessor.PREPROCESSED_SIZE) {
+                _cache.release(new ByteArray(preprocessed));
+                _context.statManager().addRateData("tunnel.corruptMessage", 1, 1);
+                return;
+            }
             padding++;
         }
         offset++; // skip the final 0x00, terminating the padding