Simple reproducer:

1. Create the following "reproducer.gdb" script

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
break src/libsystemd/sd-bus/sd-bus.c:2748

commands
	if (r == 1)
		printf "r = %d; bus's FD = %d; sleeping 25 seconds to enter condition\n", r, bus->output_fd
		shell sleep 25
	else
		if (r == -110)
			printf "r = %d; bus's FD = %d; condition met, systemd should be leaking now\n", r, bus->output_fd
			delete
		end
	end
	continue
end

continue
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

2. Attach gdb to running systemd with reproducer

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# gdb -x reproducer.gdb /usr/lib/systemd/systemd 1
[...]
Breakpoint 1 at 0x56421918c2c8: file src/libsystemd/sd-bus/sd-bus.c, line 2748.
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

3. From another terminal, execute systemctl

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# systemctl
Failed to list units: Connection timed out
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

gdb output:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
Breakpoint 1, bus_process_internal (bus=0x56421a570230, hint_priority=hint_priority@entry=false, 
    priority=priority@entry=0, ret=ret@entry=0x0) at src/libsystemd/sd-bus/sd-bus.c:2748
2748	                if (r == -ENOTCONN || r == -ECONNRESET || r == -EPIPE || r == -ESHUTDOWN) {
r = 1; bus's FD = 21; sleeping 25 seconds to enter condition

Breakpoint 1, bus_process_internal (bus=0x56421a570230, hint_priority=hint_priority@entry=false, 
    priority=priority@entry=0, ret=ret@entry=0x0) at src/libsystemd/sd-bus/sd-bus.c:2748
2748	                if (r == -ENOTCONN || r == -ECONNRESET || r == -EPIPE || r == -ESHUTDOWN) {
r = -110; bus's FD = 21; condition met, systemd should be leaking now
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

4. Watch memory growing with time passing

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# grep VmRSS /proc/1/status
VmRSS:	  210772 kB
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

The growth will stop once wqueue for the leaking bus is full (~480 MB).

BEWARE: don't hit Ctrl-C to stop gdb, or else the system will panic.
Instead, use the following command: kill -CONT 1
Then use "quit" at the gdb prompt.

Comparing the RHEL8 and RHEL7 code, I was wondering why I couldn't reproduce.
It appears that the following commit must be backported to RHEL7:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
commit 5ae37ad833583e6c1c7765767b7f8360afca3b07
Author: Lennart Poettering <lennart>
Date:   Fri Dec 15 22:24:16 2017 +0100

    sd-bus: when attached to an sd-event loop, disconnect on processing errors
    
    If we can't process the bus for some reason we shouldn't just disable
    the event source, but log something and give up on the connection. Hence
    do that, and disconnect.
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

In a nutshell, upon receiving -ETIMEDOUT, no special handling should be done in bus_process_internal() but in io_callback() instead.

fix merged to github master branch -> https://github.com/systemd-rhel/rhel-7/pull/71

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Low: systemd security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:4007