The deferred cleanup in the constructor checked a local error variable rather than the error being returned, so failures after the VFS was created (such as an invalid --passive-port) never shut it down. Name the error return so the cleanup sees the returned error.