I have not seen this, but it could be that the path is opened by another process? This persists across reboots? I wonder if you set the other path to another tmpfs location?

could be, osqueryd was essentially HUP after upgrade to kill old 3.3.0 daemon and start new 4.0.2. no other changes were made during the upgrade. this is on a few hundred machines