Suricata

It may be a false positive here. All returns are preceded by a close call with fd param but the first which is the case where we handle the failure. By the way, I've got no error with cppcheck 1.67 by running:

cppcheck --enable=all --force --inconclusive --std=posix  src/util-ioctl.c --quiet

I wonder if the "Mismatching allocation and deallocation: fd" are about using 'close' instead of 'shutdown'?