Exp_SttyCmd() opens a tty when stty is invoked with input
redirection to a tty other than /dev/tty. The descriptor is closed on
the normal path before falling back to the external stty command.
Queries such as stty rows with a redirected tty and stty columns with a
redirected tty jump to the shared done label before that close, leaking
the descriptor. An open failure after exp_trap_off() also returns before
the trap is restored.
Track the redirected descriptor and saved argv entry across the function
and release them from the done path. Keep closing the descriptor before
calling external stty on the normal path.
Found by Linux Verification Center (linuxtesting.org) with SVACE.