diff --git a/third_party/mbedtls/ssl_srv.c b/third_party/mbedtls/ssl_srv.c
index 78012e153d1..56cf851f2c0 100644
--- a/third_party/mbedtls/ssl_srv.c
+++ b/third_party/mbedtls/ssl_srv.c
@@ -1363,7 +1363,7 @@ static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
     /* [jart] grab some client ciphers for error messages */
     bzero(ssl->client_ciphers, sizeof(ssl->client_ciphers));
     for( i = j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
-        if( !p[0] && i < ARRAYLEN( ssl->client_ciphers ) )
+        if( !p[0] && i+1 < ARRAYLEN( ssl->client_ciphers ) )
             ssl->client_ciphers[i++] = p[1] << 8 | p[2];
 
 #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
@@ -2208,7 +2208,7 @@ static int ssl_parse_client_hello( mbedtls_ssl_context *ssl )
     /* [jart] grab some client ciphers for error messages */
     bzero(ssl->client_ciphers, sizeof(ssl->client_ciphers));
     for( i = j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
-        if( i < ARRAYLEN( ssl->client_ciphers ) )
+        if( i+1 < ARRAYLEN( ssl->client_ciphers ) )
             ssl->client_ciphers[i++] = p[0] << 8 | p[1];
 
     /*
diff --git a/tool/net/help.txt b/tool/net/help.txt
index 1d30e15ac29..89f8d70e11c 100644
--- a/tool/net/help.txt
+++ b/tool/net/help.txt
@@ -79,6 +79,7 @@ FLAGS
   -P PATH   pid file location
   -U INT    daemon set user id
   -G INT    daemon set group id
+  -w PATH   launch browser on startup
   --strace  enables system call tracing (see also -Z)
   --ftrace  enables function call tracing (see also -f)
 
diff --git a/tool/net/redbean.c b/tool/net/redbean.c
index 17dc732d693..a4527d921fb 100644
--- a/tool/net/redbean.c
+++ b/tool/net/redbean.c
@@ -187,10 +187,11 @@ STATIC_YOINK("ShowCrashReportsEarly");
     }                                                                  \
   } while (0)
 
-// letters not used: EINOQYnoqwxy
+// letters not used: INOQYnoqwxy
 // digits not used:  0123456789
 // puncts not used:  !"#$&'()+,-./;<=>@[\]^_`{|}~
-#define GETOPTS "*%BJSVXZabdfghijkmsuvzA:C:D:F:G:H:K:L:M:P:R:T:U:W:c:e:l:p:r:t:"
+#define GETOPTS \
+  "*%BEJSVXZabdfghijkmsuvzA:C:D:F:G:H:K:L:M:P:R:T:U:W:c:e:l:p:r:t:w:"
 
 static const uint8_t kGzipHeader[] = {
     0x1F,        // MAGNUM
@@ -7174,6 +7175,7 @@ static void GetOpts(int argc, char *argv[]) {
       CASE('u', uniprocess = true);
       CASE('g', loglatency = true);
       CASE('m', logmessages = true);
+      CASE('w', launchbrowser = strdup(optarg));
       CASE('l', ProgramAddr(optarg));
       CASE('H', ProgramHeader(optarg));
       CASE('L', ProgramLogPath(optarg));