What steps will reproduce the problem?
Run tests for os/exec.
What is the expected output? What do you see instead?
Additional part of test shows that an extra file descriptor of
type DTYPE_MISC is leaked to the child.
This is related to opening /dev/urandom, which results in a cloned file descriptor. The
underlying cause is due to Read in crypto/rand/rand_unix.go having an os.Open() call,
but no matching Close() call. This means that anything that does rand.Reader.Read() will
open a file descriptor that never gets closed (and in NetBSD we get one that is cloned).
My current guess is that FD_CLOEXEC does not work for cloned descriptors, however
further digging is required...
