1. Downstream sometimes patches packages to solve problems. Patches can have bugs.

2. A bug may be triggered by the presence of two conflicting libraries or configuration settings that appear in the version sets chosen by a distro.