diff --git a/ChangeLog b/ChangeLog
index f51c4951..46afa167 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,7 @@ Changes in 1.4.12-stable:
  o Try to contain degree of failure when running on a win32 version so heavily firewalled that we can't fake a socketpair.
  o Fix an obscure timing-dependent, allocator-dependent crash in the evdns code.
  o Use __VA_ARGS__ syntax for varargs macros in event_rpcgen when compiler is not GCC.
+ o Fix another pair of fencepost bugs in epoll.c.  [Patch from Adam Langley.]
 
 Changes in 1.4.11-stable:
  o Fix a bug when removing a timeout from the heap. [Patch from Marko Kreen]
diff --git a/epoll.c b/epoll.c
index bfb3140e..b479b9c0 100644
--- a/epoll.c
+++ b/epoll.c
@@ -171,7 +171,7 @@ epoll_recalc(struct event_base *base, void *arg, int max)
 		int nfds;
 
 		nfds = epollop->nfds;
-		while (nfds < max)
+		while (nfds <= max)
 			nfds <<= 1;
 
 		fds = realloc(epollop->fds, nfds * sizeof(struct evepoll));
@@ -226,7 +226,7 @@ epoll_dispatch(struct event_base *base, void *arg, struct timeval *tv)
 		struct event *evread = NULL, *evwrite = NULL;
 		int fd = events[i].data.fd;
 
-		if (fd < 0 && fd >= epollop->nfds)
+		if (fd < 0 || fd >= epollop->nfds)
 			continue;
 		evep = &epollop->fds[fd];