This bug allowed the last hop to learn the route length. See Breaking and (Partially) Fixing Provably Secure Onion Routing