When the BR fails to send packets for some reason, and the error is not tagged as temporary or recoverable, the posix output routine will drain the ring until it is closed.
see:

However, the ring will only be closed if the socket is shutdown, and not in the error case.

The proposed solution is to fatal out in case of a non-recoverable/non-temporary error and classify errors as they pop-up.
This is reasonable, because the BR will be in a broken state when the go routine is busy emptying the ring.