Index: tlsBIO.c
==================================================================
--- tlsBIO.c
+++ tlsBIO.c
@@ -84,35 +84,38 @@
     int bufLen;
 {
     Tcl_Channel chan = Tls_GetParent((State*)bio->ptr);
     int ret = 0;
 
-    dprintf("BioRead(%p, <buf>, %d) [%p]",
-	    (void *) bio, bufLen, (void *) chan);
+    dprintf("BioRead(%p, <buf>, %d) [%p]", (void *) bio, bufLen, (void *) chan);
 
     if (buf == NULL) return 0;
 
     if (channelTypeVersion == TLS_CHANNEL_VERSION_2) {
 	ret = Tcl_ReadRaw(chan, buf, bufLen);
     } else {
 	ret = Tcl_Read(chan, buf, bufLen);
     }
 
-    dprintf("[%p] BioRead(%d) -> %d [%d.%d]",
+    dprintf("[%p] BioRead(%d) -> %d [tclEof=%d; tclErrno=%d]",
 	    (void *) chan, bufLen, ret, Tcl_Eof(chan), Tcl_GetErrno());
 
     BIO_clear_flags(bio, BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY);
 
     if (ret == 0) {
 	if (!Tcl_Eof(chan)) {
+            dprintf("Got 0 from Tcl_Read or Tcl_ReadRaw, and EOF is set -- ret == -1 now");
 	    BIO_set_retry_read(bio);
 	    ret = -1;
 	}
     }
     if (BIO_should_write(bio)) {
 	BIO_set_retry_write(bio);
     }
+
+    dprintf("BioRead(%p, <buf>, %d) [%p] returning %i", (void *) bio, bufLen, (void *) chan, ret);
+
     return ret;
 }
 
 static int
 BioPuts	(bio, str)

Index: tlsIO.c
==================================================================
--- tlsIO.c
+++ tlsIO.c
@@ -334,18 +334,23 @@
 
     dprintf("BIO_read(%d)", bufSize);
 
     if (statePtr->flags & TLS_TCL_CALLBACK) {
        /* don't process any bytes while verify callback is running */
+       dprintf("Callback is running, reading 0 bytes");
+
        bytesRead = 0;
        goto input;
     }
 
     if (!SSL_is_init_finished(statePtr->ssl)) {
 	bytesRead = Tls_WaitForConnect(statePtr, errorCodePtr);
 	if (bytesRead <= 0) {
+            dprintf("Got an error (bytesRead = %i)", bytesRead);
+
 	    if (*errorCodePtr == ECONNRESET) {
+                dprintf("Got connection reset");
 		/* Soft EOF */
 		*errorCodePtr = 0;
 		bytesRead = 0;
 	    }
 	    goto input;