Open Radar

 
Summary:
Process' file descriptor table slot is being leaked.

First Reported here -
https://github.com/facebook/osquery/issues/3984

Steps to Reproduce:
message "Too many open files in system" converted to "Too many open files" got me curious and I believe this is bug. It led me to -
https://opensource.apple.com/source/xnu/xnu-4570.1.46/bsd/kern/kern_descrip.c.auto.html

function falloc_withalloc_locked()
static int
falloc_withalloc_locked(proc_t p, struct fileproc **resultfp, int *resultfd,
	vfs_context_t ctx, fp_allocfn_t fp_zalloc, void *crarg,
	int locked) 
{
...
...
	if ( (error = fdalloc(p, 0, &nfd)) ) {
		if (!locked)
			proc_fdunlock(p);
		return (error);
	}

	if (nfiles >= maxfiles) {
		if (!locked)
			proc_fdunlock(p);
		tablefull("file");
		return (ENFILE);
	}
...
}

Change of message from "Too many open files in system" to "Too many open files" is manifestation of a bug in the form of resource leak ( process's file descriptor table slot is being leaked here) -
Call to fdalloc(p, 0, &nfd) checks that if the process is opening more than the number of files it can open and reserve a slot in the file-descriptor table which is returned via nfd.

If "(nfiles >= maxfiles) " fails then is not un-reserving that slot. That way here is the resource leak.
If these two if conditions are swapped then it solves this problem.