Asked another way, what situation would make a file handle that just had close() called on it not release back to the OS?

close can fail, but if close succeeds, then there are four possibilities

• the monitoring program is lying (cached data...)
• the operating system is lying (think of chroot)
• you're looking at the wrong thing at the wrong time and reaching the wrong conclusion
• cosmic rays/gremlins

To me, it just looks like you're opening too many pings at one time