diff --git a/libtorrent/src/kademlia/routing_table.cpp b/libtorrent/src/kademlia/routing_table.cpp
index 02a7ffb12..c0ba68080 100644
--- a/libtorrent/src/kademlia/routing_table.cpp
+++ b/libtorrent/src/kademlia/routing_table.cpp
@@ -386,7 +386,7 @@ void routing_table::find_node(node_id const& target
 	// [0, bucket_index) if we are to include ourself
 	// or [1, bucket_index) if not.
 	bucket_t tmpb;
-	for (int i = include_self?0:1; i < count; ++i)
+	for (int i = include_self?0:1; i < bucket_index; ++i)
 	{
 		bucket_t& b = m_buckets[i].first;
 		std::remove_copy_if(b.begin(), b.end(), std::back_inserter(tmpb)
diff --git a/libtorrent/src/peer_connection.cpp b/libtorrent/src/peer_connection.cpp
index 7b8c93b5d..dbc6f4e43 100755
--- a/libtorrent/src/peer_connection.cpp
+++ b/libtorrent/src/peer_connection.cpp
@@ -1345,15 +1345,10 @@ namespace libtorrent
 				// remove the request that just finished
 				// from the download queue plus the
 				// skipped blocks.
-				m_download_queue.erase(m_download_queue.begin()
-					, boost::next(b));
+				m_download_queue.erase(m_download_queue.begin(), b);
+				b = m_download_queue.begin();
+				TORRENT_ASSERT(*b == block_finished);
 			}
-			else
-			{
-				m_download_queue.erase(b);
-			}
-
-			t->cancel_block(block_finished);
 		}
 		else
 		{
@@ -1380,6 +1375,7 @@ namespace libtorrent
 		{
 			t->received_redundant_data(p.length);
 
+			m_download_queue.erase(b);
 			request_a_block(*t, *this);
 			send_block_requests();
 			return;
@@ -1389,7 +1385,16 @@ namespace libtorrent
 			, self(), _1, _2, p, t));
 		m_outstanding_writing_bytes += p.length;
 		TORRENT_ASSERT(!m_reading);
+		m_download_queue.erase(b);
+
+		// did we request this block from any other peers?
+		bool multi = picker.num_peers(block_finished) > 1;
+
 		picker.mark_as_writing(block_finished, peer_info_struct());
+
+		// if we requested this block from other peers, cancel it now
+		if (multi) t->cancel_block(block_finished);
+
 #ifndef NDEBUG
 		t->check_invariant();
 #endif
diff --git a/libtorrent/src/torrent.cpp b/libtorrent/src/torrent.cpp
index dc2902096..81d091a35 100755
--- a/libtorrent/src/torrent.cpp
+++ b/libtorrent/src/torrent.cpp
@@ -1534,6 +1534,8 @@ namespace libtorrent
 
 	void torrent::cancel_block(piece_block block)
 	{
+		INVARIANT_CHECK;
+
 		for (peer_iterator i = m_connections.begin()
 			, end(m_connections.end()); i != end; ++i)
 		{
diff --git a/libtorrent/src/upnp.cpp b/libtorrent/src/upnp.cpp
index 5e9953fbc..dac6ef91f 100644
--- a/libtorrent/src/upnp.cpp
+++ b/libtorrent/src/upnp.cpp
@@ -471,6 +471,8 @@ void upnp::post(upnp::rootdevice const& d, std::string const& soap
 	, std::string const& soap_action)
 {
 	TORRENT_ASSERT(d.magic == 1337);
+	TORRENT_ASSERT(d.upnp_connection);
+
 	std::stringstream header;
 	
 	header << "POST " << d.control_url << " HTTP/1.1\r\n"
@@ -491,6 +493,17 @@ void upnp::post(upnp::rootdevice const& d, std::string const& soap
 void upnp::create_port_mapping(http_connection& c, rootdevice& d, int i)
 {
 	TORRENT_ASSERT(d.magic == 1337);
+
+	if (!d.upnp_connection)
+	{
+		TORRENT_ASSERT(d.disabled);
+#ifdef TORRENT_UPNP_LOGGING
+		m_log << time_now_string() << " *** mapping (" << i
+			<< ") aborted" << std::endl;
+#endif
+		return;
+	}
+	
 	std::string soap_action = "AddPortMapping";
 
 	std::stringstream soap;
@@ -548,6 +561,17 @@ void upnp::map_port(rootdevice& d, int i)
 void upnp::delete_port_mapping(rootdevice& d, int i)
 {
 	TORRENT_ASSERT(d.magic == 1337);
+
+	if (!d.upnp_connection)
+	{
+		TORRENT_ASSERT(d.disabled);
+#ifdef TORRENT_UPNP_LOGGING
+		m_log << time_now_string() << " *** unmapping (" << i
+			<< ") aborted" << std::endl;
+#endif
+		return;
+	}
+
 	std::stringstream soap;
 	
 	std::string soap_action = "DeletePortMapping";