I understand the files_preserve parameter, the bug I'm filling is the innability of SysLogHandler to reopen the socket, although it tries :

// DaemonContext closing all FDs:
close(3)                                = 0
close(2)                                = 0
close(1)                                = 0
close(0)                                = 0

[...]

// Trying to send "World !" to the closed socket (developper missusing files_preserve
sendto(3, "<14>World !\0", 12, 0, NULL, 0) = -1 EBADF (Bad file descriptor)

// Reopening socket, with good parameters
socket(PF_FILE, SOCK_DGRAM, 0)          = 3

// WTF ? For me, the bug is here, why do we close it ?
// That's not the DaemonContext that closes the file here, as we already are in daemonContext, all files were closed before by the DaemonContext, so for me it's SysLogHandler who's closing here and it's a bug :
close(3)                                = 0

// Trying to connect to a closed socket ... will fail )o:
connect(3, {sa_family=AF_FILE, path="/dev/log"}, 10) = -1 EBADF (Bad file descriptor)

// Reclosing it ? ok ... why not as we don't know that it were closed.
close(3)                                = -1 EBADF (Bad file descriptor)

// Trying another socket type, cause first try failed, but failed cause the close(), it may have not been closed and have succeed. So this try may no apprear normally :
socket(PF_FILE, SOCK_STREAM, 0)         = 3
connect(3, {sa_family=AF_FILE, path="/dev/log"}, 10) = -1 EPROTOTYPE (Protocol wrong type for socket)