diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c
index 6e971328af..dac0a5c893 100644
--- a/src/or/connection_edge.c
+++ b/src/or/connection_edge.c
@@ -417,7 +417,8 @@ connection_ap_expire_beginning(void)
     circ->timestamp_dirty -= options->MaxCircuitDirtiness;
     /* give our stream another 'cutoff' seconds to try */
     conn->_base.timestamp_lastread += cutoff;
-    conn->num_socks_retries++;
+    if (conn->num_socks_retries < 250) /* avoid overflow */
+      conn->num_socks_retries++;
     /* move it back into 'pending' state, and try to attach. */
     if (connection_ap_detach_retriable(conn, TO_ORIGIN_CIRCUIT(circ))<0) {
       connection_mark_unattached_ap(conn, END_STREAM_REASON_CANT_ATTACH);
diff --git a/src/or/or.h b/src/or/or.h
index b07cec267b..cb21a3c0bd 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -713,7 +713,7 @@ typedef struct edge_connection_t {
   /** Number of times we've reassigned this application connection to
    * a new circuit. We keep track because the timeout is longer if we've
    * already retried several times. */
-  int num_socks_retries;
+  uint8_t num_socks_retries;
 
   /** Nickname of planned exit node -- used with .exit support. */
   char *chosen_exit_name;