AIKIDO-2026-211008

TL;DR

The UpdateHub over-the-air client leaks its CoAP/DTLS socket descriptor on connection-setup failure paths because the cleanup step is gated on a flag that is already cleared when the socket is opened. When the DTLS option or the connect step fails, the descriptor is never closed and is overwritten by the next attempt, permanently leaking it from the shared socket pool. The failing path runs on every periodic OTA poll when the server is unreachable or when traffic is disrupted, so repeated failures gradually exhaust the pool and degrade device networking until reboot. The fix closes the open socket on the failure paths.