diff --git a/src/core/or/conflux.c b/src/core/or/conflux.c
index 0082089504..0a2806b1dc 100644
--- a/src/core/or/conflux.c
+++ b/src/core/or/conflux.c
@@ -604,6 +604,12 @@ conflux_decide_next_circ(conflux_t *cfx)
   // this once tuning is complete.
   conflux_validate_legs(cfx);
 
+  /* If the conflux set is tearing down and has no current leg,
+   * bail and give up */
+  if (cfx->in_full_teardown) {
+    return NULL;
+  }
+
   /* If we don't have a current leg yet, pick one.
    * (This is the only non-const operation in this function). */
   if (!cfx->curr_leg) {
diff --git a/src/core/or/conflux_util.c b/src/core/or/conflux_util.c
index 7e2e938ca4..9d1a4bd308 100644
--- a/src/core/or/conflux_util.c
+++ b/src/core/or/conflux_util.c
@@ -38,6 +38,13 @@ circuit_get_package_window(circuit_t *circ,
       tor_assert_nonfatal(circ->purpose ==
                           CIRCUIT_PURPOSE_CONFLUX_LINKED);
     }
+    circuit_t *orig_circ = circ;
+
+    /* If conflux is in the process of tearing down the set,
+     * the package window is 0 -- there is no room. */
+    if (circ->conflux->in_full_teardown)
+      return 0;
+
     circ = conflux_decide_next_circ(circ->conflux);
 
     /* If conflux has no circuit to send on, the package window is 0. */