I'm still a but baffled as to why this wasn't seen earlier.
A FreeBSD testcase started failing with kernel 13.2 patch 2,
which is quite a minor change. The testcase gets an fd from
pdfork and the parent does a printf with the fd then zaps the
process with pdkill. Standalone the fd is 3, and that's what
the expected contains. However, when it started failing I saw
with lsof that fds 3 and 4 were associated with the guest exe
and ld-elf.so.1.