bin/48988: Strange init-inherited? descriptors on netbsd-6

[Matthew Mondor <mm_lists%pulsar-zone.net@localhost>]

>Number:         48988
>Category:       bin
>Synopsis:       Strange init-inherited? descriptors on netbsd-6
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jul 12 12:20:00 +0000 2014
>Originator:     Matthew Mondor
>Release:        NetBSD 6.1_STABLE
>Organization:
>Environment:
System: NetBSD ninja.xisop 6.1_STABLE NetBSD 6.1_STABLE (GENERIC_MM) #3: Mon 
Jul 1 19:08:46 EDT 2013 
root@ninja.xisop:/usr/obj/sys/arch/amd64/compile/GENERIC_MM amd64
Architecture: x86_64
Machine: amd64
>Description:

I noticed lately that a daemon I wrote sometimes had unexpected extra
descriptors.  Then I realized that this only occurs when it is started
at boot, and that many programs are affected.  This does not occur on
netbsd-5.  I don't think it's a critical security or resources issue
yet, but I assume that it's a bug and that it can be fixed.  I also
assume that those descriptors are inherited from init, but a quick grep
for close-on-exec, pipe or socketpair related searches did not show
matches, and I've not had the time to audit the init code yet.

It's also unclear yet why fstat falls back to flags mode for two of the
three leaking descriptors (and it's not related to my other fstat
related bin/48925 PR).

I noticed that some daemons are particularily careful to close all
potential descriptors after dup2(2), such as an ircd; but most
otherwise well-behaving daemons are affected.

>How-To-Repeat:

# fstat
[...]
root     cron         710    7 flags 0x280014<ISTTY,MPSAFE,CLEAN,INACTREDO>
root     cron         710    8 flags 0x280014<ISTTY,MPSAFE,CLEAN,INACTREDO>
root     cron         710    9* pipe 0xfffffe810ecffdc0 -> 0x0 w
[...]
root     inetd        729    7 flags 0x280014<ISTTY,MPSAFE,CLEAN,INACTREDO>
root     inetd        729    8 flags 0x280014<ISTTY,MPSAFE,CLEAN,INACTREDO>
root     inetd        729    9* pipe 0xfffffe810ecffdc0 -> 0x0 w
[...]
root     powerd       373    7 flags 0x280014<ISTTY,MPSAFE,CLEAN,INACTREDO>
root     powerd       373    8 flags 0x280014<ISTTY,MPSAFE,CLEAN,INACTREDO>
root     powerd       373    9* pipe 0xfffffe810ecffdc0 -> 0x0 w
[...]
root     syslogd      172    7 flags 0x280014<ISTTY,MPSAFE,CLEAN,INACTREDO>
root     syslogd      172    8 flags 0x280014<ISTTY,MPSAFE,CLEAN,INACTREDO>
root     syslogd      172    9* pipe 0xfffffe810ecffdc0 -> 0x0 w
[...various other system and third party daemons, and sh scripts...]

>Fix:
        Unknown yet, to analyse