The resolver can leak UDP sockets if the first nameserver in /etc/resolv.conf is down or invalid and the second is valid. To test this, I wrote a sort program that ran gethostbyname in a loop and ran it under strace and watched the descriptor numbers steadily increase.
Do you have latest glibc errata installed? This looks like duplicate of #18332 which has been fixed in glibc-2.2-12.
*** This bug has been marked as a duplicate of 18332 ***