ESTABLISHED sockets with no fd open? (was: generating ECONNRESET with no syscall?)

[Edgar Fuß <ef%math.uni-bonn.de@localhost>]

On Wed, Apr 20, 2016 at 02:52:20PM +0200, Edgar Fuß wrote:
> We have two production web servers, both running lighttpd, the first still 
> running on NetBSD 4.0.1, the second on 6.1. Occasioally, on the second, you 
> get Connection Reset by Peer (NOT Connection Refused) on the HTTP port. 
Meanwhile, both servers are on 6.1 and now both exhibit the problem.

In the broken state, according to netstat, there are ~190 sockets in the 
ESTABLISHED state with a local port number of 80, while the lighttpd process 
(the only one listening on port 80) has ~no file descriptors open.

So, next question: Is it legally possible for a user process to be responsible 
for a socket being in the ESTABLISHED state without having an fd open?