swrap: always check new fd's against socket_fds_max and use libc_close() for cleanup