Match channel and circid, not just circid
In one or two places in the code, we try to tell which circuit a cell is on doing something like:
if (!CIRCUIT_IS_ORIGIN(circ) &&
cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id) {
But that's wrong! There is no reason at all a circuit cannot have p_circ_id == n_circ_id.