diff --git a/changes/bug1038-3 b/changes/bug1038-3
new file mode 100644
index 000000000..5af4afa46
--- /dev/null
+++ b/changes/bug1038-3
@@ -0,0 +1,6 @@
+  o Minor bugfixes:
+    - Warn and drop the circuit if we receive an inbound 'relay early'
+      cell. Those used to be normal to receive on hidden service circuits
+      due to bug 1038, but the buggy Tor versions are long gone from
+      the network so we can afford to resume watching for them. Resolves
+      the rest of bug 1038; bugfix on 0.2.1.19.
diff --git a/changes/bug12718 b/changes/bug12718
new file mode 100644
index 000000000..0c5f70844
--- /dev/null
+++ b/changes/bug12718
@@ -0,0 +1,5 @@
+  o Minor bugfixes:
+    - Correct a confusing error message when trying to extend a circuit
+      via the control protocol but we don't know a descriptor or
+      microdescriptor for one of the specified relays. Fixes bug 12718;
+      bugfix on 0.2.3.1-alpha.
diff --git a/src/or/channel.c b/src/or/channel.c
index 964b3fcac..3072effc8 100644
--- a/src/or/channel.c
+++ b/src/or/channel.c
@@ -3352,7 +3352,7 @@ channel_dump_statistics(channel_t *chan, int severity)
       U64_PRINTF_ARG(chan->timestamp_recv),
       U64_PRINTF_ARG(now - chan->timestamp_recv));
   tor_log(severity, LD_GENERAL,
-      " * Channel " U64_FORMAT " last trasmitted a cell "
+      " * Channel " U64_FORMAT " last transmitted a cell "
       "at " U64_FORMAT " (" U64_FORMAT " seconds ago)",
       U64_PRINTF_ARG(chan->global_identifier),
       U64_PRINTF_ARG(chan->timestamp_xmit),
diff --git a/src/or/command.c b/src/or/command.c
index fa2a0e74e..1f6f93a86 100644
--- a/src/or/command.c
+++ b/src/or/command.c
@@ -474,10 +474,22 @@ command_process_relay_cell(cell_t *cell, channel_t *chan)
    * gotten no more than MAX_RELAY_EARLY_CELLS_PER_CIRCUIT of them. */
   if (cell->command == CELL_RELAY_EARLY) {
     if (direction == CELL_DIRECTION_IN) {
-      /* Allow an unlimited number of inbound relay_early cells,
-       * for hidden service compatibility. There isn't any way to make
-       * a long circuit through inbound relay_early cells anyway. See
-       * bug 1038. -RD */
+      /* Inbound early cells could once be encountered as a result of
+       * bug 1038; but relays running versions before 0.2.1.19 are long
+       * gone from the network, so any such cells now are surprising. */
+      log_warn(LD_OR,
+               "Received an inbound RELAY_EARLY cell on circuit %u."
+               " Closing circuit. Please report this event,"
+               " along with the following message.",
+               (unsigned)cell->circ_id);
+      if (CIRCUIT_IS_ORIGIN(circ)) {
+        circuit_log_path(LOG_WARN, LD_OR, TO_ORIGIN_CIRCUIT(circ));
+      } else if (circ->n_chan) {
+        log_warn(LD_OR, " upstream=%s",
+                 channel_get_actual_remote_descr(circ->n_chan));
+      }
+      circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
+      return;
     } else {
       or_circuit_t *or_circ = TO_OR_CIRCUIT(circ);
       if (or_circ->remaining_relay_early_cells == 0) {
diff --git a/src/or/control.c b/src/or/control.c
index 21504e685..9285fc564 100644
--- a/src/or/control.c
+++ b/src/or/control.c
@@ -2464,7 +2464,7 @@ handle_control_extendcircuit(control_connection_t *conn, uint32_t len,
       goto done;
     }
     if (!node_has_descriptor(node)) {
-      connection_printf_to_buf(conn, "552 descriptor for \"%s\"\r\n", n);
+      connection_printf_to_buf(conn, "552 No descriptor for \"%s\"\r\n", n);
       goto done;
     }
     smartlist_add(nodes, (void*)node);