The connection-pool line carries a mechanism. `let _ = socket.into_inner();` appears in the post under a comment saying it drops the socket without closing it [13]. That is what descriptor exhaustion looks like from the inside: `into_inner` consumes the wrapper and hands back the inner stream, binding it to `_` drops it immediately, and with a tokio `TcpStream` built through `FromRawFd` the descriptor's ownership is whatever the author wired up [14]. The published text stops mid-sentence at the clause that would have explained the rest [14].
The getrandom attribution has no comparable chain. The post says a transitive dependency of `ring`, which `trust-dns` used for DNS-over-HTTPS, was holding onto entropy pools differently [5]. Entropy pool handling and thousands of open sockets under `lsof` [2] are never joined anywhere in the piece. The chain also runs through the library that had already been dropped: `trust-dns` felt heavy, so the author wrote his own resolver [1], and the leak is then pinned on something `trust-dns` pulled in via `ring` [5]. Either both were still in the graph after the replacement, or the attribution does not hold.
`cargo tree -e features` returned 87 crates for a DNS resolver [7]. Half arrived behind `tokio-postgres`, added to log resolution metrics, and half of those behind `serde_json`, serializing a struct that was never sent anywhere [8]. Half of 87 is about 44, which puts roughly 22 crates on the far side of a serializer whose output had no destination [1]. Deleting `tokio-postgres`, hand-rolling a 40-line `fmt::Write` serializer and removing three debugging macros [9] took the binary from 4.2 MB to 1.8 MB [10] and the clean build from 92 seconds to 37 [11]. That is 2.4 MB, or 57 percent [2], and 55 seconds, or 60 percent [3].
Whether those numbers transfer turns on one condition: your graph has to contain a database client behind an observability feature. If it does, the shape repeats. If your dependencies are all load-bearing, deleting them costs features, not seconds.
Replacing a heavy library relocated the audit problem rather than removing it, but in a narrower form than the post's framing suggests. The author says as much, that he replaced one dependency with another and forgot to audit the entire tree [6]. What the rewrite did not remove was the obligation to read the tree, and the two days spent instrumenting every `.await` point and building a 50k-connection fuzz harness [4] were spent on code that was not where the fd count was coming from.
Rust's default release profile panics on integer overflow while the debug profile wraps, and the test suite ran in debug, so an overflow in a packet length calculation reached production before anything caught it [15]. The fix, `#![deny(arithmetic_side_effects)]` plus a CI job that runs the tests in release mode [16], does not make the arithmetic correct. It makes the tests run the semantics that ship.
He kept the resolver [17]. That is defensible on the terms he states: faster for his use case, smaller, and he knows which RFCs he skipped [17][18]. Faster for his use case is a claim about his traffic.
