diff --git a/src/arachne.c b/src/arachne.c
index 3727df9..2b8a00e 100644
--- a/src/arachne.c
+++ b/src/arachne.c
@@ -1706,7 +1706,7 @@ createNewTermGeneric (Termlist tl, Term t)
   Term newterm;
 
   /* Determine first free number */
-  freenumber = 0;
+  freenumber = sys->maxruns;
   tlscan = tl;
   while (tlscan != NULL)
     {
@@ -1832,6 +1832,8 @@ deleteNewTerm (Term t)
  * People find reading variables in attack outputs difficult.
  * Thus, we instantiate them in a sensible way to make things more readable.
  *
+ * This happens after sys->maxruns is fixed. Intruder constants thus are numbered from sys->maxruns onwards.
+ *
  * \sa makeTraceClass
  */
 Termlist
diff --git a/src/dotout.c b/src/dotout.c
index 39c7851..8879b02 100644
--- a/src/dotout.c
+++ b/src/dotout.c
@@ -67,28 +67,37 @@ printVisualRun (int rid)
   int displayr;
   int display;
 
-  displayi = 0;
-  displayr = 0;
-  for (run = 0; run < rid; run++)
+  if (rid < sys->maxruns)
     {
-      if (sys->runs[run].protocol != INTRUDER)
+      // < sys->maxruns means normal thing (not from makeTraceConcrete)
+      displayi = 0;
+      displayr = 0;
+      for (run = 0; run < rid; run++)
 	{
-	  displayr++;
+	  if (sys->runs[run].protocol != INTRUDER)
+	    {
+	      displayr++;
+	    }
+	  else
+	    {
+	      displayi++;
+	    }
+	}
+      if (sys->runs[rid].protocol == INTRUDER)
+	{
+	  display = sys->maxruns + displayi + 1;
 	}
       else
 	{
-	  displayi++;
+	  display = displayr + 1;
 	}
-    }
-  if (sys->runs[rid].protocol == INTRUDER)
-    {
-      display = sys->maxruns + displayi + 1;
+      eprintf ("#%i", display);
     }
   else
     {
-      display = displayr + 1;
+      // >= sys->maxruns means intruder choice
+      eprintf ("%i", (rid - sys->maxruns + 1));
     }
-  eprintf ("#%i", display);
 }
 
 //! Remap term stuff