diff --git a/cf-check/dump.c b/cf-check/dump.c
index 6ded3c8bbd..2086d877e1 100644
--- a/cf-check/dump.c
+++ b/cf-check/dump.c
@@ -414,24 +414,41 @@ static int dump_db(const char *file, const dump_mode mode, const char *tskey_fil
     MDB_dbi dbi;
     MDB_cursor *cursor = NULL;
 
-    if (0 != (r = mdb_env_create(&env))
-        || 0 != (r = mdb_env_open(env, file, MDB_NOSUBDIR | MDB_RDONLY, 0644))
-        || 0 != (r = mdb_txn_begin(env, NULL, MDB_RDONLY, &txn))
-        || 0 != (r = mdb_open(txn, NULL, 0, &dbi))
-        || 0 != (r = mdb_cursor_open(txn, dbi, &cursor)))
+    r = mdb_env_create(&env);
+    if (r != 0)
     {
-        if (env != NULL)
-        {
-            if (txn != NULL)
-            {
-                if (cursor != NULL)
-                {
-                    mdb_cursor_close(cursor);
-                }
-                mdb_txn_abort(txn);
-            }
-            mdb_env_close(env);
-        }
+        return dump_report_error(r);
+    }
+
+    /* If this function fails, mdb_env_close() must be called to discard the MDB_env handle. */
+    r = mdb_env_open(env, file, MDB_NOSUBDIR | MDB_RDONLY, 0644);
+    if (r != 0)
+    {
+        mdb_env_close(env);
+        return dump_report_error(r);
+    }
+
+    r = mdb_txn_begin(env, NULL, MDB_RDONLY, &txn);
+    if (r != 0)
+    {
+        mdb_env_close(env);
+        return dump_report_error(r);
+    }
+
+    /* If the transaction is aborted the database handle will be closed automatically. */
+    r = mdb_open(txn, NULL, 0, &dbi);
+    if (r != 0)
+    {
+        mdb_txn_abort(txn);
+        mdb_env_close(env);
+        return dump_report_error(r);
+    }
+
+    r = mdb_cursor_open(txn, dbi, &cursor);
+    if (r != 0)
+    {
+        mdb_txn_abort(txn);
+        mdb_env_close(env);
         return dump_report_error(r);
     }
 
@@ -462,11 +479,12 @@ static int dump_db(const char *file, const dump_mode mode, const char *tskey_fil
     if (r != MDB_NOTFOUND)
     {
         // At this point, not found is expected, anything else is an error
+        mdb_cursor_close(cursor);
+        mdb_txn_abort(txn);
+        mdb_env_close(env);
         return dump_report_error(r);
     }
     mdb_cursor_close(cursor);
-    mdb_close(env, dbi);
-
     mdb_txn_abort(txn);
     mdb_env_close(env);
 
diff --git a/libpromises/bootstrap.c b/libpromises/bootstrap.c
index 58e40fdccc..e79a92294a 100644
--- a/libpromises/bootstrap.c
+++ b/libpromises/bootstrap.c
@@ -215,12 +215,14 @@ bool WriteAmPolicyHubFile(bool am_policy_hub)
     {
         if (!GetAmPolicyHub())
         {
-            if (creat(filename, 0600) == -1)
+            int fd = creat(filename, 0600);
+            if (fd == -1)
             {
                 Log(LOG_LEVEL_ERR, "Error writing marker file '%s'", filename);
                 free(filename);
                 return false;
             }
+            close(fd);
         }
     }
     else
diff --git a/tests/acceptance/testall b/tests/acceptance/testall
index adc73a6c9d..be3274b91b 100755
--- a/tests/acceptance/testall
+++ b/tests/acceptance/testall
@@ -109,7 +109,7 @@ DIFF=${DIFF:-}                      ; export DIFF
 LIBTOOL=${LIBTOOL:-}                ; export LIBTOOL
 INCLUDE_IN_WORKDIR=${INCLUDE_IN_WORKDIR:-} ; export INCLUDE_IN_WORKDIR
 
-VALGRIND_OPTS="${VALGRIND_OPTS:---leak-check=full --show-reachable=yes --suppressions=valgrind-suppressions}"
+VALGRIND_OPTS="${VALGRIND_OPTS:---leak-check=full --show-reachable=yes --suppressions=valgrind-suppressions --track-fds=yes}"
 export VALGRIND_OPTS
 
 export MAKEFLAGS
diff --git a/tests/valgrind-check/valgrind.sh b/tests/valgrind-check/valgrind.sh
index 34716fec64..211e13f57e 100644
--- a/tests/valgrind-check/valgrind.sh
+++ b/tests/valgrind-check/valgrind.sh
@@ -86,7 +86,7 @@ make install
 
 /var/cfengine/bin/cf-agent --version
 
-VG_OPTS="--leak-check=full --track-origins=yes --error-exitcode=1"
+VG_OPTS="--leak-check=full --track-origins=yes --error-exitcode=1 --track-fds=yes"
 BOOTSTRAP_IP="127.0.0.1"
 
 valgrind $VG_OPTS /var/cfengine/bin/cf-key 2>&1 | tee cf-key.txt