LWN's 2012 retrospective

A harder-to-predict leap-second bug was the bug in ntpd when you have low-stratum servers mutually synchronizing with other servers at the same stratum, and with no servers at a lower stratum, that led to some people seeing a second leap second a month after the first. This was old, old, fairly-well-tested code (as leap second code goes: operators of low-stratum servers generally do tend to test this stuff in advance, but it wouldn't have helped here unless they'd tested it on an entire cluster of servers at once and then examined the state of the leap-second flag afterwards...)