diff --git a/CHANGELOG b/CHANGELOG
index 60f558a..6320d3e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,11 +1,13 @@
 2020-10-13
-    - 2.23.0
+    - 2.23.1
     - [FEATURE] IETF Client 0-RTT support.
     - [BUGFIX] Do not schedule MTU probe on first tick.
     - [BUGFIX] Parsing DATAGRAM frame.
     - [BUGFIX] If push promise fails, do not invoke hset destructor.
     - [BUGFIX] Client: When connections are IDed by port number, check DCID.
       Fixes issue #176.
+    - [BUGFIX] Regression introduced in 2.22.0: use correct number of
+      PNSs for IETF mini conn during promotion.
     - Revert the 2.22.1 lsquic_is_valid_hs_packet change.  All that was
       necessary is a change to the way we call it in lsquic_engine.  No
       change to the function itself is required.
diff --git a/docs/conf.py b/docs/conf.py
index d28c75c..426b4d2 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -26,7 +26,7 @@ author = u'LiteSpeed Technologies'
 # The short X.Y version
 version = u'2.23'
 # The full version, including alpha/beta/rc tags
-release = u'2.23.0'
+release = u'2.23.1'
 
 
 # -- General configuration ---------------------------------------------------
diff --git a/include/lsquic.h b/include/lsquic.h
index 287b44a..a8fe16d 100644
--- a/include/lsquic.h
+++ b/include/lsquic.h
@@ -25,7 +25,7 @@ extern "C" {
 
 #define LSQUIC_MAJOR_VERSION 2
 #define LSQUIC_MINOR_VERSION 23
-#define LSQUIC_PATCH_VERSION 0
+#define LSQUIC_PATCH_VERSION 1
 
 /**
  * Engine flags:
diff --git a/src/liblsquic/lsquic_conn.h b/src/liblsquic/lsquic_conn.h
index c742bf5..1497dbc 100644
--- a/src/liblsquic/lsquic_conn.h
+++ b/src/liblsquic/lsquic_conn.h
@@ -19,6 +19,10 @@
 #include <ws2ipdef.h>
 #endif
 
+#ifndef LSQUIC_TEST
+#define LSQUIC_TEST 0
+#endif
+
 struct lsquic_conn;
 struct lsquic_engine_public;
 struct lsquic_packet_out;
diff --git a/src/liblsquic/lsquic_full_conn_ietf.c b/src/liblsquic/lsquic_full_conn_ietf.c
index 3b904ff..983adc3 100644
--- a/src/liblsquic/lsquic_full_conn_ietf.c
+++ b/src/liblsquic/lsquic_full_conn_ietf.c
@@ -1561,12 +1561,15 @@ lsquic_ietf_full_conn_server_new (struct lsquic_engine_public *enpub,
     for (pns = 0; pns < IMICO_N_PNS; ++pns)
     {
         lsquic_imico_rechist_init(&mini_rechist, imc, pns);
-        if (0 != lsquic_rechist_copy_ranges(&conn->ifc_rechist[pns],
-                                &mini_rechist, lsquic_imico_rechist_first,
-                                lsquic_imico_rechist_next))
-            goto err2;
-        conn->ifc_rechist[pns].rh_largest_acked_received
+        if (pns < IMICO_N_PNS)
+        {
+            if (0 != lsquic_rechist_copy_ranges(&conn->ifc_rechist[pns],
+                                    &mini_rechist, lsquic_imico_rechist_first,
+                                    lsquic_imico_rechist_next))
+                goto err2;
+            conn->ifc_rechist[pns].rh_largest_acked_received
                                                 = imc->imc_largest_recvd[pns];
+        }
     }
 
     /* Mini connection sends out packets 0, 1, 2... and so on.  It deletes
@@ -1620,7 +1623,7 @@ lsquic_ietf_full_conn_server_new (struct lsquic_engine_public *enpub,
      * to add packet renumbering logic to the mini conn.
      */
 
-    for (pns = 0; pns < N_PNS; ++pns)
+    for (pns = 0; pns < IMICO_N_PNS; ++pns)
         for (i = 0; i < 4; ++i)
         {
             conn->ifc_ecn_counts_in[pns][i]  = imc->imc_ecn_counts_in[pns][i];
diff --git a/src/liblsquic/lsquic_hpi.h b/src/liblsquic/lsquic_hpi.h
index de19f7a..14f0283 100644
--- a/src/liblsquic/lsquic_hpi.h
+++ b/src/liblsquic/lsquic_hpi.h
@@ -11,6 +11,10 @@
 #ifndef LSQUIC_HPI
 #define LSQUIC_HPI 1
 
+#ifndef LSQUIC_TEST
+#define LSQUIC_TEST 0
+#endif
+
 struct lsquic_conn_public;
 
 /* We add 1 to the urgency when we place them on hpi_streams.  Critical
diff --git a/src/liblsquic/lsquic_mini_conn_ietf.c b/src/liblsquic/lsquic_mini_conn_ietf.c
index b52ba43..3c5127a 100644
--- a/src/liblsquic/lsquic_mini_conn_ietf.c
+++ b/src/liblsquic/lsquic_mini_conn_ietf.c
@@ -1616,6 +1616,7 @@ void
 lsquic_imico_rechist_init (struct ietf_mini_rechist *rechist,
                     const struct ietf_mini_conn *conn, enum packnum_space pns)
 {
+    assert(pns < IMICO_N_PNS);
     rechist->conn = conn;
     rechist->pns  = pns;
     if (conn->imc_flags & IMC_TRECHIST)
diff --git a/src/liblsquic/lsquic_rechist.h b/src/liblsquic/lsquic_rechist.h
index 7ad4ccb..02b1204 100644
--- a/src/liblsquic/lsquic_rechist.h
+++ b/src/liblsquic/lsquic_rechist.h
@@ -8,6 +8,9 @@
 #ifndef LSQUIC_RECHIST_H
 #define LSQUIC_RECHIST_H 1
 
+#ifndef LSQUIC_TEST
+#define LSQUIC_TEST 0
+#endif
 
 /* Structure is exposed to facilitate some manipulations in unit tests. */
 struct rechist_elem {