> Would it be possible to modify FreeBSD to enable it by default? Or is there a reason to not enable it by default?

That's very unlikely to happen. I believe it was added as an opt-in feature for some linux compatibility situations. The correct solution is to use closefrom(2), as it is the optimal current solution, and in our case, safe to use.

> Which patch? https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=221700#c3 or something else?

Yep, that one.

> It seems like closefrom() is available on:

Per #8052 there was some concerns about closefrom(2) not being async-signal safe. [1] 

I can't speak to other implementations, but this is what I requested clarity from our FreeBSD developers on, and confirmed that our implementation is indeed safe. That is the reason why I thought scoping closefrom(2) to __FreeBSD__ may be warranted, just like like the linux specific bits in https://hg.python.org/cpython/rev/61aa484a3e54 from #8052

But I'll leave the decision as to how its implemented (configure checkls, ifdef'd or not) in your capable hands.

Summary: FreeBSD's closefrom(2) is safe to anywhere in Python where it needs to close a range of fd's, including the subprocess module.

[1] https://bugs.python.org/issue8052#msg132307