[PATCH 1/1] sandbox: don't call os_close with invalid file descriptor