diff --git a/include/ZeroTierOne.h b/include/ZeroTierOne.h
index 5b478afbd..98413a21a 100644
--- a/include/ZeroTierOne.h
+++ b/include/ZeroTierOne.h
@@ -1270,6 +1270,11 @@ typedef struct {
 	 */
 	struct sockaddr_storage receivedFromRemoteAddress;
 
+	/**
+	 * Path link quality of physical path over which test was received
+	 */
+	int receivedFromLinkQuality;
+
 	/**
 	 * Next hops to which packets are being or will be sent by the reporter
 	 *
diff --git a/node/IncomingPacket.cpp b/node/IncomingPacket.cpp
index 85b06d500..9c13a283f 100644
--- a/node/IncomingPacket.cpp
+++ b/node/IncomingPacket.cpp
@@ -1342,7 +1342,7 @@ bool IncomingPacket::_doCIRCUIT_TEST(const RuntimeEnvironment *RR,const SharedPt
 			outp.append((uint8_t)hops());
 			_path->localAddress().serialize(outp);
 			_path->address().serialize(outp);
-			outp.append((uint16_t)0); // no additional fields
+			outp.append((uint16_t)_path->linkQuality());
 			outp.append((uint8_t)breadth);
 			for(unsigned int h=0;h<breadth;++h) {
 				nextHop[h].appendTo(outp);
@@ -1399,16 +1399,20 @@ bool IncomingPacket::_doCIRCUIT_TEST_REPORT(const RuntimeEnvironment *RR,const S
 
 		const unsigned int receivedOnLocalAddressLen = reinterpret_cast<InetAddress *>(&(report.receivedOnLocalAddress))->deserialize(*this,ZT_PACKET_IDX_PAYLOAD + 58);
 		const unsigned int receivedFromRemoteAddressLen = reinterpret_cast<InetAddress *>(&(report.receivedFromRemoteAddress))->deserialize(*this,ZT_PACKET_IDX_PAYLOAD + 58 + receivedOnLocalAddressLen);
+		unsigned int ptr = ZT_PACKET_IDX_PAYLOAD + 58 + receivedOnLocalAddressLen + receivedFromRemoteAddressLen;
+		if (report.protocolVersion >= 9) {
+			report.receivedFromLinkQuality = at<uint16_t>(ptr); ptr += 2;
+		} else {
+			report.receivedFromLinkQuality = ZT_PATH_LINK_QUALITY_MAX;
+			ptr += at<uint16_t>(ptr) + 2; // this field was once an 'extended field length' reserved field, which was always set to 0
+		}
 
-		unsigned int nhptr = ZT_PACKET_IDX_PAYLOAD + 58 + receivedOnLocalAddressLen + receivedFromRemoteAddressLen;
-		nhptr += at<uint16_t>(nhptr) + 2; // add "additional field" length, which right now will be zero
-
-		report.nextHopCount = (*this)[nhptr++];
+		report.nextHopCount = (*this)[ptr++];
 		if (report.nextHopCount > ZT_CIRCUIT_TEST_MAX_HOP_BREADTH) // sanity check, shouldn't be possible
 			report.nextHopCount = ZT_CIRCUIT_TEST_MAX_HOP_BREADTH;
 		for(unsigned int h=0;h<report.nextHopCount;++h) {
-			report.nextHops[h].address = Address(field(nhptr,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH).toInt(); nhptr += ZT_ADDRESS_LENGTH;
-			nhptr += reinterpret_cast<InetAddress *>(&(report.nextHops[h].physicalAddress))->deserialize(*this,nhptr);
+			report.nextHops[h].address = Address(field(ptr,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH).toInt(); ptr += ZT_ADDRESS_LENGTH;
+			ptr += reinterpret_cast<InetAddress *>(&(report.nextHops[h].physicalAddress))->deserialize(*this,ptr);
 		}
 
 		RR->node->postCircuitTestReport(&report);
diff --git a/node/Network.cpp b/node/Network.cpp
index dc976f03c..e4b91bb6d 100644
--- a/node/Network.cpp
+++ b/node/Network.cpp
@@ -1422,6 +1422,7 @@ Membership::AddCredentialResult Network::addCredential(const Address &sentFrom,c
 				outp.append((uint16_t)0); // no capabilities
 				outp.append((uint16_t)0); // no tags
 				outp.append((uint16_t)1); // one revocation!
+				outp.append((uint16_t)0); // no certificates of ownership
 				rev.serialize(outp);
 				RR->sw->send(outp,true);
 			}
diff --git a/node/Packet.hpp b/node/Packet.hpp
index d5817708b..87863b191 100644
--- a/node/Packet.hpp
+++ b/node/Packet.hpp
@@ -1041,8 +1041,7 @@ public:
 		 *   <[1] 8-bit packet hop count of received CIRCUIT_TEST>
 		 *   <[...] local wire address on which packet was received>
 		 *   <[...] remote wire address from which packet was received>
-		 *   <[2] 16-bit length of additional fields>
-		 *   <[...] additional fields>
+		 *   <[2] 16-bit path link quality of path over which packet was received>
 		 *   <[1] 8-bit number of next hops (breadth)>
 		 *   <[...] next hop information>
 		 *