This function has file descriptor leaks;quiche/quiche/examples/server.c/gen_cid

static uint8_t *gen_cid(uint8_t *cid, size_t cid_len) {
int rng = open("/dev/urandom", O_RDONLY);
if (rng < 0) {
perror("failed to open /dev/urandom");
return NULL;
}

ssize_t rand_len = read(rng, cid, cid_len);
if (rand_len < 0) {
perror("failed to create connection ID");
return NULL;
}

return cid;
}
**you did't close the fd when your return**

Open examples/server.c and inspect gen_cid, starting with its /dev/urandom open and both error and success returns. Confirm the file-descriptor lifetime and run the example's available build or test checks; done means the descriptor is released on every return path without changing the generated connection ID behavior.

Written by the indexing model from the issue text.