diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c
index fd758be75d..b36d0d9013 100644
--- a/src/core/or/connection_edge.c
+++ b/src/core/or/connection_edge.c
@@ -4234,8 +4234,10 @@ connection_exit_begin_resolve(cell_t *cell, or_circuit_t *circ)
       break;
     case DOS_STREAM_DEFENSE_REFUSE_STREAM:
       dns_send_resolved_error_cell(dummy_conn, RESOLVED_TYPE_ERROR_TRANSIENT);
+      connection_free_(TO_CONN(dummy_conn));
       return 0;
     case DOS_STREAM_DEFENSE_CLOSE_CIRCUIT:
+      connection_free_(TO_CONN(dummy_conn));
       return -END_CIRC_REASON_RESOURCELIMIT;
   }
 
diff --git a/src/core/or/dos.c b/src/core/or/dos.c
index 632a49888d..b789f87aae 100644
--- a/src/core/or/dos.c
+++ b/src/core/or/dos.c
@@ -357,9 +357,9 @@ set_dos_parameters(const networkstatus_t *ns)
 
   /* Stream. */
   dos_stream_enabled = get_param_stream_enabled(ns);
-  dos_stream_defense_type = get_param_stream_rate(ns);
-  dos_stream_rate = get_param_stream_burst(ns);
-  dos_stream_burst = get_param_stream_defense_type(ns);
+  dos_stream_defense_type = get_param_stream_defense_type(ns);
+  dos_stream_rate = get_param_stream_rate(ns);
+  dos_stream_burst = get_param_stream_burst(ns);
 }
 
 /* Free everything for the circuit creation DoS mitigation subsystem. */