See issue 13173 for details; we should make sure that tlstunnel waits on its children properly.
Noticed this on castro too with 3.3.0.
This is because tlstunnel's child handling is all kinds of broken. Inside the main loop, we call a non-blocking waitpid() on our children, but then call a blocking accept() call while we wait for new connections. This means that children which exit after waitpid() but during accept() will not be reaped until the next iteration of the loop; i.e. until a new connection is made. After this, new zombie processes will eventually be created. We can probably do better than this.
(In reply to comment #2) > We can probably do better than this. We should either write our own SIGCHLD handler, or ignore SIGCHLD completely. Probably the latter.
Created attachment 484 [details] Suggested patch to avoid having to wait on child processes
r27743
Verified and works as expected on SLED11 Sp2 ThinLinc build 4110. Tested both webadmin and webaccess.