diff --git a/src/syscall/fs.rs b/src/syscall/fs.rs
index 46944d3b00..9ead4aff49 100644
--- a/src/syscall/fs.rs
+++ b/src/syscall/fs.rs
@@ -101,15 +101,21 @@ pub fn openat(
 
         match res? {
             OpenResult::SchemeLocal(number, internal_flags) => {
-                Arc::new(RwLock::new(FileDescription {
-                    offset: 0,
-                    internal_flags,
-                    scheme: scheme_id,
-                    number,
-                    flags: (flags & !O_CLOEXEC) as u32,
-                }))
+                FileDescriptor {
+                    description: Arc::new(RwLock::new(FileDescription {
+                        offset: 0,
+                        internal_flags,
+                        scheme: scheme_id,
+                        number,
+                        flags: (flags & !O_CLOEXEC) as u32,
+                    })),
+                    cloexec: flags & O_CLOEXEC == O_CLOEXEC,
+                }
             }
-            OpenResult::External(desc) => desc,
+            OpenResult::External(desc) => FileDescriptor {
+                description: desc,
+                cloexec: flags & O_CLOEXEC == O_CLOEXEC,
+            },
         }
     };
 
@@ -118,10 +124,7 @@ pub fn openat(
     let (context, mut token) = current.token_split();
     context
         .add_file(
-            FileDescriptor {
-                description: new_description,
-                cloexec: flags & O_CLOEXEC == O_CLOEXEC,
-            },
+            new_description,
             &mut token,
         )
         .ok_or(Error::new(EMFILE))
@@ -148,7 +151,24 @@ pub fn openat_into(
     let new_description = {
         let scheme = scheme::get_scheme(token.token(), scheme_id)?;
         let res = scheme.kopenat(number, StrOrBytes::from_str(&path_buf), flags, fcntl_flags, caller_ctx, token)?;
-        res?
+        match res {
+            OpenResult::SchemeLocal(number, internal_flags) => {
+                FileDescriptor {
+                    description: Arc::new(RwLock::new(FileDescription {
+                        offset: 0,
+                        internal_flags,
+                        scheme: scheme_id,
+                        number,
+                        flags: (flags & !O_CLOEXEC) as u32,
+                    })),
+                    cloexec: flags & O_CLOEXEC == O_CLOEXEC,
+                }
+            }
+            OpenResult::External(desc) => FileDescriptor {
+                description: desc,
+                cloexec: flags & O_CLOEXEC == O_CLOEXEC,
+            },
+        }
     };
     let current_lock = context::current();
     let mut current = current_lock.read(token.token());
@@ -269,7 +289,7 @@ pub fn dup_into(
     buf: UserSliceRo,
     token: &mut CleanLockToken,
 ) -> Result<FileHandle> {
-    let new_file = duplicate_file(fd, buf, token)?;
+    let new_file = duplicate_file(fd, buf, false, token)?;
     let current_lock = context::current();
     let mut current = current_lock.read(token.token());
     let (context, mut token) = current.token_split();
diff --git a/src/syscall/mod.rs b/src/syscall/mod.rs
index a2528c6759..82090fc339 100644
--- a/src/syscall/mod.rs
+++ b/src/syscall/mod.rs
@@ -218,7 +218,8 @@ pub fn syscall(
                 f as u32,
                 FileHandle::from(g as usize),
                 token,
-            ),
+            )
+            .map(FileHandle::into),
             SYS_OPENAT_WITH_FILTER => openat(
                 fd,
                 UserSlice::ro(c, d)?,