copyReg(): open out_fd with O_RDWR, fixed resource leak in error-case