There are many more "imap" processes without any network connection though.
These are the important processes then. What do ktrace and gdb backtraces show for them?
Okay, here is one that no longer has an network connection:
(gdb) bt full #0 0x2811d590 in ?? () No symbol table info available. #1 0x80a9230 in ?? () No symbol table info available. #2 0x80a8915 in ?? () No symbol table info available. #3 0x806104d in _fini () No symbol table info available. #4 0x8055ac9 in i_stream_create_file (fd=-1077937284, pool=0x0, max_buffer_size=3217030017, autoclose_fd=-1077937263) at istream-file.c:236 pool = 0x0 max_buffer_size = 135102512 fstream = (struct file_istream *) 0x80ca560 st = {st_dev = 3217029756, st_ino = 3217029664, st_mode = 4159, st_nlink = 2054, st_uid = 3217029740, st_gid = 671912909, st_rdev = 3217029740, st_atimespec = {tv_sec = 134568649, tv_nsec = 1}, st_mtimespec = {tv_sec = -1077937548, tv_nsec = -1077937540}, st_ctimespec = {tv_sec = 647, tv_nsec = -1077937556}, st_size = 577967886526927274, st_blocks = 134943496, st_blksize = 0, st_flags = 0, st_gen = 3217029736, st_lspare = 0, st_qspare = { -4629706567330037760, 2885872453060393580}}
Nothing for ktrace though. With ktracing enabled, next time doing gdb did add details (but maybe not related):
99399 imap PSIG SIGINT caught handler=0x80a92ec mask=0x0 code=0x0 99399 imap RET kevent -1 errno 4 Interrupted system call 99399 imap CALL write(0x6,0xbfbff7a3,0x1) 99399 imap GIO fd 6 wrote 1 byte "\^B" 99399 imap RET write 1 99399 imap CALL sigreturn(0xbfbff7c0) 99399 imap RET sigreturn JUSTRETURN 99399 imap CALL write(0x2,0x80cb1e0,0x2b) 99399 imap GIO fd 2 wrote 43 bytes "\^AFkevent() failed: Interrupted system call " 99399 imap RET write 43/0x2b 99399 imap CALL sigprocmask(0x1,0x280d9be0,0xbfbff8a0) 99399 imap RET sigprocmask 0 99399 imap CALL sigprocmask(0x3,0x280d9bf0,0) 99399 imap RET sigprocmask 0 99399 imap CALL exit(0x59)
Can you see if file descriptors still exist for the sockets? In Linux I'd do that with ls -l /proc/pid/fd/
Yes, they do. fstat shows the "internet stream tcp" for them with file descriptor 0 and 1. The ones that still have a network connection also display the address of the socket, like:
USER CMD PID FD MOUNT INUM MODE SZ|DV R/W user imap 4711 0* internet stream tcp d5fcd640 user imap 4711 1* internet stream tcp d5fcd640 user imap 99399 0* internet stream tcp user imap 99399 1* internet stream tcp