diff --git a/proxy_mutator.c b/proxy_mutator.c
index c79e0df0c..12374cf54 100644
--- a/proxy_mutator.c
+++ b/proxy_mutator.c
@@ -456,7 +456,6 @@ mut_step_n(rescodecopy) {
 
 // TODO: take a string or number from that position.
 mut_step_r(rescodecopy) {
-    struct mcp_mutator *mut = run->mut;
     // FIXME: error propagation
     // FIXME: can we do all the error handling in the totalling phase?
     if (p->slen < 2) {
@@ -919,8 +918,8 @@ static int mcp_mutator_new(lua_State *L, enum mcp_mut_type type) {
 
             // copy function pointers into the step so we don't have to skip
             // around the much larger mcp_mut_entries at runtime.
-            mut->steps[x].n = mcp_mut_entries[st].n;
-            mut->steps[x].r = mcp_mut_entries[st].r;
+            mut->steps[scount].n = mcp_mut_entries[st].n;
+            mut->steps[scount].r = mcp_mut_entries[st].r;
         }
         lua_pop(L, 1); // drop t or nil
         scount++;
@@ -968,12 +967,17 @@ static inline int _mcp_mut_run_assemble(struct mcp_mut_run *run, struct mcp_mut_
         if (s->r(run, s, &parts[x]) < 0) {
             assert(1 == 0);
         }
+
+        *(run->d_pos) = ' ';
+        run->d_pos++;
     }
 
+    // TODO: any cases where we need to check if the final char is a space or
+    // not?
     // add the \r\n after all steps
-    *(run->d_pos) = '\r';
-    *(run->d_pos+1) = '\n';
-    run->d_pos += 2;
+    *(run->d_pos-1) = '\r';
+    *(run->d_pos) = '\n';
+    run->d_pos++;
 
     return 0;
 }
diff --git a/t/proxymut.t b/t/proxymut.t
index 76510e852..23aa238f3 100644
--- a/t/proxymut.t
+++ b/t/proxymut.t
@@ -52,3 +52,5 @@ sub test_mg {
         $t->clear();
     };
 }
+
+done_testing();