diff --git a/usr.sbin/ctld/ctld.hh b/usr.sbin/ctld/ctld.hh
--- a/usr.sbin/ctld/ctld.hh
+++ b/usr.sbin/ctld/ctld.hh
@@ -144,7 +144,7 @@
 	bool reuse_socket(portal &oldp);
 	bool init_socket();
 	virtual bool init_socket_options(int s __unused) { return true; }
-	virtual void handle_connection(int fd, const char *host,
+	virtual void handle_connection(freebsd::fd_up fd, const char *host,
 	    const struct sockaddr *client_sa) = 0;
 
 	portal_group *portal_group() { return p_portal_group; }
diff --git a/usr.sbin/ctld/ctld.cc b/usr.sbin/ctld/ctld.cc
--- a/usr.sbin/ctld/ctld.cc
+++ b/usr.sbin/ctld/ctld.cc
@@ -2166,7 +2166,7 @@
 }
 
 static void
-handle_connection(struct portal *portal, int fd,
+handle_connection(struct portal *portal, freebsd::fd_up fd,
     const struct sockaddr *client_sa, bool dont_fork)
 {
 	struct portal_group *pg;
@@ -2197,10 +2197,8 @@
 		pid = fork();
 		if (pid < 0)
 			log_err(1, "fork");
-		if (pid > 0) {
-			close(fd);
+		if (pid > 0)
 			return;
-		}
 		conf->close_pidfile();
 	}
 
@@ -2214,7 +2212,7 @@
 	log_set_peer_addr(host);
 	setproctitle("%s", host);
 
-	portal->handle_connection(fd, host, client_sa);
+	portal->handle_connection(std::move(fd), host, client_sa);
 	log_debugx("nothing more to do; exiting");
 	exit(0);
 }
diff --git a/usr.sbin/ctld/iscsi.hh b/usr.sbin/ctld/iscsi.hh
--- a/usr.sbin/ctld/iscsi.hh
+++ b/usr.sbin/ctld/iscsi.hh
@@ -36,8 +36,8 @@
 #define	CONN_SESSION_TYPE_NORMAL	2
 
 struct iscsi_connection {
-	iscsi_connection(struct portal *portal, int fd, const char *host,
-	    const struct sockaddr *client_sa);
+	iscsi_connection(struct portal *portal, freebsd::fd_up fd,
+	    const char *host, const struct sockaddr *client_sa);
 	~iscsi_connection();
 
 	void handle();
@@ -61,6 +61,7 @@
 	struct portal		*conn_portal = nullptr;
 	const struct port	*conn_port = nullptr;
 	struct target		*conn_target = nullptr;
+	freebsd::fd_up		conn_fd;
 	int			conn_session_type = CONN_SESSION_TYPE_NONE;
 	std::string		conn_initiator_name;
 	std::string		conn_initiator_addr;
diff --git a/usr.sbin/ctld/iscsi.cc b/usr.sbin/ctld/iscsi.cc
--- a/usr.sbin/ctld/iscsi.cc
+++ b/usr.sbin/ctld/iscsi.cc
@@ -61,7 +61,7 @@
 		portal(pg, listen, protocol, std::move(ai)) {}
 
 	bool init_socket_options(int s) override;
-	void handle_connection(int fd, const char *host,
+	void handle_connection(freebsd::fd_up fd, const char *host,
 	    const struct sockaddr *client_sa) override;
 };
 
@@ -410,13 +410,13 @@
 {
 }
 
-iscsi_connection::iscsi_connection(struct portal *portal, int fd,
+iscsi_connection::iscsi_connection(struct portal *portal, freebsd::fd_up fd,
     const char *host, const struct sockaddr *client_sa) :
-	conn_portal(portal), conn_initiator_addr(host),
+	conn_portal(portal), conn_fd(std::move(fd)), conn_initiator_addr(host),
 	conn_initiator_sa(client_sa)
 {
 	connection_init(&conn, &conn_ops, proxy_mode);
-	conn.conn_socket = fd;
+	conn.conn_socket = conn_fd;
 }
 
 iscsi_connection::~iscsi_connection()
@@ -496,12 +496,12 @@
 }
 
 void
-iscsi_portal::handle_connection(int fd, const char *host,
+iscsi_portal::handle_connection(freebsd::fd_up fd, const char *host,
     const struct sockaddr *client_sa)
 {
 	struct conf *conf = portal_group()->conf();
 
-	iscsi_connection conn(this, fd, host, client_sa);
+	iscsi_connection conn(this, std::move(fd), host, client_sa);
 	start_timer(conf->timeout(), true);
 	kernel_capsicate();
 	conn.handle();
diff --git a/usr.sbin/ctld/login.cc b/usr.sbin/ctld/login.cc
--- a/usr.sbin/ctld/login.cc
+++ b/usr.sbin/ctld/login.cc
@@ -752,7 +752,7 @@
 		conn_max_burst_limit = (1 << 24) - 1;
 		conn_first_burst_limit = (1 << 24) - 1;
 		kernel_limits(pg->offload(),
-		    conn.conn_socket,
+		    conn_fd,
 		    &conn_max_recv_data_segment_limit,
 		    &conn_max_send_data_segment_limit,
 		    &conn_max_burst_limit,