In some email I received from Greg A. Woods, sie wrote:
[...]
> The folks on <squid-bugs@ircache.net> have suggested:
> 
>     The most likely explanation is that the version of the OS kernel you
>     use has a busted implementation of accept(), leaking filedescriptors
>     on some kind of internal error (probably fails to handle aborted
>     connects or something similar).
> 
> and I would tend to agree given what I've been seeing and other similar
> bad history I've had with various implementations.
[...]

This bug has been fixed and some time ago.  The fix is trivial enough
that you should be able to copy the changes back to 1.3.3 if you don't
want to upgrade to 1.4.1 or -current.

I found and fixed the bug without submitting a PR when I was working on
testing how system calls handled programmed failure conditions.

Darren