diff --git a/usr.sbin/paxctl/paxctl.c b/usr.sbin/paxctl/paxctl.c
index 89f971241b33..418208dfce68 100644
--- a/usr.sbin/paxctl/paxctl.c
+++ b/usr.sbin/paxctl/paxctl.c
@@ -1,4 +1,4 @@
-/* $NetBSD: paxctl.c,v 1.9 2009/01/18 10:01:34 lukem Exp $ */
+/* $NetBSD: paxctl.c,v 1.10 2009/05/02 06:01:30 elad Exp $ */
 
 /*-
  * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
@@ -34,7 +34,7 @@
 #include <sys/cdefs.h>
 #ifndef lint
 #ifdef __RCSID
-__RCSID("$NetBSD: paxctl.c,v 1.9 2009/01/18 10:01:34 lukem Exp $");
+__RCSID("$NetBSD: paxctl.c,v 1.10 2009/05/02 06:01:30 elad Exp $");
 #endif
 #endif /* not lint */
 
@@ -204,11 +204,13 @@ process_one(const char *name, uint32_t add_flags, uint32_t del_flags,
 
 	if (read(fd, &e, sizeof(e)) != sizeof(e)) {
 		warn("Can't read ELF header from `%s'", name);
+		(void)close(fd);
 		return 1;
 	}
 
 	if (memcmp(e.h32.e_ident, ELFMAG, SELFMAG) != 0) {
 		warnx("Bad ELF magic from `%s' (maybe it's not an ELF?)", name);
+		(void)close(fd);
 		return 1;
 	}
 
@@ -227,6 +229,7 @@ process_one(const char *name, uint32_t add_flags, uint32_t del_flags,
 	} else {
 		warnx("Bad ELF size %d from `%s' (maybe it's not an ELF?)",
 		    (int)e.h32.e_ehsize, name);
+		(void)close(fd);
 		return 1;
 	}
 
@@ -234,6 +237,7 @@ process_one(const char *name, uint32_t add_flags, uint32_t del_flags,
 		if ((size_t)pread(fd, &p, PHSIZE, (off_t)EH(e_phoff) + i * PHSIZE) !=
 		    PHSIZE) {
 			warn("Can't read program header data from `%s'", name);
+			(void)close(fd);
 			return 1;
 		}
 
@@ -242,6 +246,7 @@ process_one(const char *name, uint32_t add_flags, uint32_t del_flags,
 
 		if (pread(fd, &n, NHSIZE, (off_t)PH(p_offset)) != NHSIZE) {
 			warn("Can't read note header from `%s'", name);
+			(void)close(fd);
 			return 1;
 		}
 		if (NH(n_type) != ELF_NOTE_TYPE_PAX_TAG ||
@@ -251,6 +256,7 @@ process_one(const char *name, uint32_t add_flags, uint32_t del_flags,
 		if (pread(fd, &pax_tag, sizeof(pax_tag), PH(p_offset) + NHSIZE)
 		    != sizeof(pax_tag)) {
 			warn("Can't read pax_tag from `%s'", name);
+			(void)close(fd);
 			return 1;
 		}
 		if (memcmp(pax_tag.name, ELF_NOTE_PAX_NAME,
@@ -258,6 +264,7 @@ process_one(const char *name, uint32_t add_flags, uint32_t del_flags,
 			warn("Unknown pax_tag name `%*.*s' from `%s'",
 			    ELF_NOTE_PAX_NAMESZ, ELF_NOTE_PAX_NAMESZ,
 			    pax_tag.name, name);
+			(void)close(fd);
 			return 1;
 		}
 		ok = 1;
@@ -287,6 +294,7 @@ process_one(const char *name, uint32_t add_flags, uint32_t del_flags,
 		if (!pax_flags_sane(SWAP(pax_tag.flags))) {
 			warnx("New flags 0x%x don't make sense",
 			    (uint32_t)SWAP(pax_tag.flags));
+			(void)close(fd);
 			return 1;
 		}