vhost: fix possible denial of service by leaking FDs