Bash redirection file descriptors not closed correctly

[b-bashbug]

Configuration Information [Automatically generated, do not change]:
Machine: i386
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i386' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i386-pc-linux-gnu' 
-DCONF_VENDOR='pc' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL 
-DHAVE_CONFIG_H  -I.  -I../bash -I../bash/include -I../bash/lib   -g -O2
uname output: Linux amidala 2.6.9 #4 Sun Nov 14 11:41:20 WST 2004 i686 GNU/Linux
Machine Type: i386-pc-linux-gnu

Bash Version: 3.0
Patch Level: 0
Release Status: release

Description:
    (Same bug filed at savannah (#103583), but an SMTP error from the web page
    when I submitted it tells me that nobody may have received it).

    With some elaborate redirections, it appears that some file descriptors are
    not being closed prior to spawning off processes. After running the script
    below, one can observe the FDs of the sleep process by typing:

    $ ls -l /proc/`pidof sleep`/fd/
    total 4
    lr-x------ 1 b b 64 Nov 18 18:32 0 -> /dev/null
    l-wx------ 1 b b 64 Nov 18 18:32 1 -> /dev/null
    l-wx------ 1 b b 64 Nov 18 18:32 10 -> pipe:[245971]
    l-wx------ 1 b b 64 Nov 18 18:32 2 -> /dev/null

    As you can see, there is an extra FD 10 there which is inherited by sleep.
    The other end of that pipe is attached to the script. Hence the script will
    hang until the sleep process terminates (or whatever other long-lived
    process or daemon is spawned by this script).

    Looking at bash's source, it appears related to the add_undo_redirect
    function in redir.c and its actions. (I suspect the issue is that the FD
    is getting its close-on-exec flag cleared inadvertently).

    The same script operates correctly under zsh and dash.

    (The reasons for the crazy redirections is to obtain the exit status of
    "Stuff" portably. In bash, PIPESTATUS would suffice but is not portable.)

    Thanks,
    Bernard.

Repeat-By:
    #!/bin/sh
    
    Stuff() {
        c=3
        ( sleep 5 < /dev/null > /dev/null 2>&1 & ) &
    }
    
    exec 3>&1
    eval `
        exec 4>&1 >&3 3>&-
        {
            Stuff 4>&-
            echo "c=$c" >&4
        }`
    
    echo c is $c