That's an interesting bug. Thanks for linking it here! Many flavours of UNIX have bugs in the area of file descriptor passing. The most recent one I spotted wa

That's an interesting bug. Thanks for linking it here! Many flavours of UNIX have bugs in the area of file descriptor passing. The most recent one I spotted was that FreeBSD would leak file descriptors on the receiving side if the cmsg space was too small to hold all incoming file descriptors numbers. Another interesting one is that garbage collection of in-flight file descriptors is sometimes implemented by effectively calling close() recursively. This means that you can cause kernel panics due to kernel stack overflows by closing a socket pair that contains in-flight file descriptors of socket pairs that contain in-flight file descriptors of socket pairs that contain in-flight file descriptors of [...]