Our deployment of Jenkins with this plugin is currently on an NFS share. In testing a job with this plugin, a file descriptor was apparently left open. We found this out when attempting to delete the test job after it ran. (It was a simple echo job to make sure masking worked as expected, nothing else)
The issue appears to be related to the anonymous sub-class of the LineTransformationOutputStream class returned by the Wrapper class and similar to the bug resolved in
JENKINS-28409 for EnvInject. The sub-class needs to clean up it's parent outputstream and the super class on close.