diff --git a/src/or/buffers.c b/src/or/buffers.c
index 2cf313f10d..fa66aeb192 100644
--- a/src/or/buffers.c
+++ b/src/or/buffers.c
@@ -50,18 +50,6 @@ int read_to_buf(int s, int at_most, char **buf, int *buflen, int *buf_datalen, i
   if(at_most == 0)
     return 0; /* we shouldn't read anything */
 
-  if(!options.LinkPadding && at_most > 10*sizeof(cell_t)) {
-    /* if no linkpadding: do a rudimentary round-robin so one
-     * connection can't hog a thickpipe
-     */
-    at_most = 10*(CELL_PAYLOAD_SIZE - RELAY_HEADER_SIZE);
-    /* XXX this still isn't perfect. now we read 10 relay data payloads per read --
-     * but if we're reading from a connection that speaks cells, we always
-     * read a partial cell from the network and can't process it yet. Good
-     * enough for now though. (And maybe best, to stress our code more.)
-     */
-  }
-
 //  log_fn(LOG_DEBUG,"reading at most %d bytes.",at_most);
   read_result = read(s, *buf+*buf_datalen, at_most);
   if (read_result < 0) {
diff --git a/src/or/connection.c b/src/or/connection.c
index ba6a77c2cf..8f2dbb24ef 100644
--- a/src/or/connection.c
+++ b/src/or/connection.c
@@ -305,8 +305,8 @@ int connection_handle_read(connection_t *conn) {
            /* XXX I suspect pollerr may make Windows not get to this point. :( */
            router_forget_router(conn->addr,conn->port); 
              /* FIXME i don't think router_forget_router works. */
-         }
-         return -1;
+        }
+        return -1;
       }
       if(connection_process_inbuf(conn) < 0) {
         //log_fn(LOG_DEBUG,"connection_process_inbuf returned %d.",retval);
@@ -322,12 +322,23 @@ int connection_handle_read(connection_t *conn) {
 
 int connection_read_to_buf(connection_t *conn) {
   int read_result;
-  int at_most = global_read_bucket;
+  int at_most;
 
-  if(connection_speaks_cells(conn)) {
-    assert(conn->receiver_bucket >= 0);
+  assert((connection_speaks_cells(conn) && conn->receiver_bucket >= 0) ||
+         (!connection_speaks_cells(conn) && conn->receiver_bucket < 0));
+
+  if(options.LinkPadding) {
+    at_most = global_read_bucket;
   } else {
-    assert(conn->receiver_bucket < 0);
+    /* do a rudimentary round-robin so one connection can't hog a thickpipe */
+    if(connection_speaks_cells(conn)) {
+      at_most = 10*(CELL_NETWORK_SIZE);
+    } else {
+      at_most = 10*(CELL_PAYLOAD_SIZE - RELAY_HEADER_SIZE);
+    }
+
+    if(at_most > global_read_bucket)
+      at_most = global_read_bucket;
   }
 
   if(conn->receiver_bucket >= 0 && at_most > conn->receiver_bucket)
@@ -348,7 +359,7 @@ int connection_read_to_buf(connection_t *conn) {
       /* If we're not in 'open' state here, then we're never going to finish the
        * handshake, because we'll never increment the receiver_bucket. But we
        * can't check for that here, because the buf we just read might have enough
-       * on it to finish the handshake. So we check for that in conn_read().
+       * on it to finish the handshake. So we check for that in connection_handle_read().
        */
     }
   }
diff --git a/src/or/or.h b/src/or/or.h
index 1e1f72a5f7..c1b625dbb2 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -34,7 +34,7 @@
 #include "../common/fakepoll.h"
 #endif
 #ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
+#include <sys/types.h> /* Must be included before sys/stat.h for Ultrix */
 #endif
 #ifdef HAVE_SYS_WAIT_H
 #include <sys/wait.h>
@@ -489,7 +489,7 @@ void buf_free(char *buf);
 int read_to_buf(int s, int at_most, char **buf, int *buflen, int *buf_datalen, int *reached_eof);
   /* grab from s, put onto buf, return how many bytes read */
 int read_to_buf_tls(tor_tls *tls, int at_most, char **buf, int *buflen, int *buf_datalen);
-  /* grab from s, put onto buf, return how many bytes read or a TLS
+  /* grab from tls, put onto buf, return how many bytes read or a TLS
    * status (same status codes as tor_tls_read) */
 
 int flush_buf(int s, char **buf, int *buflen, int *buf_flushlen, int *buf_datalen);