diff --git a/src/test/test_channel.c b/src/test/test_channel.c
index 2f07413ad7..add57deb50 100644
--- a/src/test/test_channel.c
+++ b/src/test/test_channel.c
@@ -896,6 +896,32 @@ test_channel_queue_impossible(void *arg)
   test_assert(test_cells_written == old_count);
   test_eq(chan_cell_queue_len(&(ch->outgoing_queue)), 0);
 
+  /* Unknown cell type case */
+  test_chan_accept_cells = 0;
+  ch->state = CHANNEL_STATE_MAINT;
+  cell = tor_malloc_zero(sizeof(cell_t));
+  make_fake_cell(cell);
+  channel_write_cell(ch, cell);
+
+  /* Check that it's queued */
+  test_eq(chan_cell_queue_len(&(ch->outgoing_queue)),1);
+  q = TOR_SIMPLEQ_FIRST(&(ch->outgoing_queue));
+  test_assert(q);
+  if (q) {
+    test_eq(q->type, CELL_QUEUE_FIXED);
+    test_eq(q->u.fixed.cell, cell);
+  }
+  /* Clobber it, including the queue entry type */
+  tor_free(q->u.fixed.cell);
+  q->u.fixed.cell = NULL;
+  q->type = CELL_QUEUE_PACKED + 1;
+
+  /* Let it drain and check that the bad entry is discarded */
+  test_chan_accept_cells = 1;
+  channel_change_state(ch, CHANNEL_STATE_OPEN);
+  test_assert(test_cells_written == old_count);
+  test_eq(chan_cell_queue_len(&(ch->outgoing_queue)), 0);
+
  done:
   tor_free(ch);
   free_cell_pool();