This bug allowed the last hop to learn the route length.

See Breaking and (Partially) Fixing Provably Secure Onion Routing