kernel: protection fault trap, code=0 Stopped at sys_semop+0x45b: movzwl 0(%rax),%r15d ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic the kernel did not panic ddb{0}> trace sys_semop(ffff800038bfc2b8,ffff80003c457640,ffff80003c457590) at sys_semop+0x45b sys/kern/sysv_sem.c:615 syscall(ffff80003c457640) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c457640) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:579 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x17e8aaf39c0, count: -3 ddb{0}> show registers rdi 0 rsi 0 rbp 0xffff80003c457560 rbx 0 rdx 0 rcx 0xffff800038bfc2b8 rax 0xdeadbeefdeadbeef r8 0x7f7fffffc000 r9 0 r10 0xe4902bf4fb69ef5a r11 0x1474ce8116efb5b0 r12 0xffff80000151b904 r13 0 r14 0xffff80003c457640 r15 0 rip 0xffffffff81d9380b sys_semop+0x45b cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff80003c457440 ss 0x10 sys_semop+0x45b: movzwl 0(%rax),%r15d ddb{0}> show proc PROC (syz-executor) tid=121564 pid=90171 tcnt=3 stat=onproc flags process=0 proc=4000000 runpri=84, usrpri=84, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800038bfc028,0xffff800038bfca78 process=0xffff80003c4dc028 user=0xffff80003c452000, vmspace=0xfffffd806ec1c788 estcpu=34, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 76560 242715 30158 0 2 0 syz-executor 76560 11726 30158 0 3 0x4000080 fsleep syz-executor 76560 319442 30158 0 3 0x4000080 fsleep syz-executor 76560 166264 30158 0 2 0x4000000 syz-executor 92115 378352 54440 0 2 0 syz-executor 91602 425708 20216 60928 2 0x10 syz-executor 91602 294909 20216 60928 2 0x4000010 syz-executor 65700 143134 26681 -1 2 0x10 syz-executor 65700 288036 26681 -1 2 0x4000010 syz-executor 43829 288580 53344 0 2 0xc80 syz-executor 43829 32894 53344 0 3 0x4000080 fsleep syz-executor 43829 209196 53344 0 3 0x4000080 fsleep syz-executor 90171 3874 6972 0 2 0 syz-executor 90171 232568 6972 0 3 0x4000080 fsleep syz-executor *90171 121564 6972 0 7 0x4000000 syz-executor 20216 515773 89036 0 2 0xc82 syz-executor 54440 430787 89036 0 3 0x82 nanoslp syz-executor 30158 294463 89036 0 2 0xc82 syz-executor 70630 38899 0 0 3 0x14280 nfsidl nfsio 13777 207867 0 0 3 0x14280 nfsidl nfsio 3181 320284 0 0 3 0x14280 nfsidl nfsio 7950 310820 0 0 3 0x14280 nfsidl nfsio 20682 135771 0 0 3 0x14280 nfsidl nfsio 95325 139018 0 0 3 0x14280 nfsidl nfsio 60068 61093 0 0 3 0x14280 nfsidl nfsio 50478 251162 0 0 3 0x14280 nfsidl nfsio 40578 23735 0 0 3 0x14280 nfsidl nfsio 80849 316065 0 0 3 0x14280 nfsidl nfsio 46276 523392 0 0 3 0x14280 nfsidl nfsio 54184 211332 0 0 3 0x14280 nfsidl nfsio 77392 51881 0 0 3 0x14280 nfsidl nfsio 19214 123230 0 0 3 0x14280 nfsidl nfsio 42828 355208 0 0 3 0x14280 nfsidl nfsio 53764 354528 0 0 3 0x14280 nfsidl nfsio 19438 313524 0 0 3 0x14280 nfsidl nfsio 5455 137527 0 0 3 0x14280 nfsidl nfsio 67648 324175 0 0 3 0x14280 nfsidl nfsio 65097 392027 0 0 3 0x14280 nfsidl nfsio 1888 248666 1 0 3 0x100083 ttyin getty 28537 35977 0 0 3 0x14200 bored sosplice 6972 194105 89036 0 3 0x82 nanoslp syz-executor 53896 406493 89036 0 2 0x2 syz-executor 53344 518500 89036 0 3 0x82 nanoslp syz-executor 26681 475656 89036 0 3 0x82 nanoslp syz-executor 89131 28652 89036 0 3 0x82 wait syz-executor 89036 240670 83391 0 3 0x82 kqread syz-executor 83391 427654 86470 0 3 0x10008a sigsusp ksh 86470 467563 43068 0 3 0x98 kqread sshd-session 43068 446904 6254 0 3 0x92 kqread sshd-session 6254 508980 1 0 3 0x88 kqread sshd 65798 72943 86106 74 3 0x1100092 bpf pflogd 86106 400977 1 0 3 0x80 sbwait pflogd 11188 305420 23208 73 3 0x1100090 kqread syslogd 23208 443067 1 0 3 0x100082 sbwait syslogd 90369 26412 1 0 3 0x100080 kqread resolvd 56597 10928 69579 77 3 0x100092 kqread dhcpleased 70036 88980 69579 77 3 0x100092 kqread dhcpleased 69579 103731 1 0 3 0x80 kqread dhcpleased 21284 497393 0 0 3 0x14200 bored smr 4744 371451 0 0 2 0x14200 zerothread 80669 443142 0 0 3 0x14200 aiodoned aiodoned 3777 467747 0 0 3 0x14200 syncer update 93091 141649 0 0 3 0x14200 cleaner cleaner 53029 73150 0 0 3 0x14200 reaper reaper 40240 21805 0 0 3 0x14200 pgdaemon pagedaemon 4132 214783 0 0 3 0x14200 bored viomb 35516 155650 0 0 3 0x40014200 acpi0 acpi0 57966 229401 0 0 7 0x40014200 idle1 47954 199047 0 0 3 0x14200 bored softnet3 86933 521558 0 0 3 0x14200 bored softnet2 20984 121067 0 0 3 0x14200 bored softnet1 79686 352401 0 0 3 0x14200 bored softnet0 77938 15992 0 0 3 0x14200 bored systqmp 75233 30735 0 0 3 0x14200 bored systq 34981 242761 0 0 3 0x14200 tmoslp softclockmp 13051 182431 0 0 2 0x40014200 softclock 4732 307500 0 0 3 0x40014200 idle0 1 456136 0 0 3 0x82 wait init 0 0 -1 0 3 0x10010200 scheduler swapper ddb{0}> show all locks Process 76560 (syz-executor) thread 0xffff8000ffff2010 (166264) exclusive rwlock inet46 r = 0 (0xffff8000015239e8) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x3ea sys/kern/kern_rwlock.c:316 #2 socreate+0x21d pru_attach sys/sys/protosw.h:-1 [inline] #2 socreate+0x21d sys/kern/uipc_socket.c:212 #3 sys_socket+0x124 sys/kern/uipc_syscalls.c:101 #4 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] #4 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579 #5 Xsyscall+0x128 shared rwlock netlock r = 0 (0xffffffff8388d1e0) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1160 #1 rw_do_enter_read+0x3af sys/kern/kern_rwlock.c:405 #2 solock_shared+0x6e sys/kern/uipc_socket2.c:343 #3 socreate+0x21d pru_attach sys/sys/protosw.h:-1 [inline] #3 socreate+0x21d sys/kern/uipc_socket.c:212 #4 sys_socket+0x124 sys/kern/uipc_syscalls.c:101 #5 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579 #6 Xsyscall+0x128 Process 92115 (syz-executor) thread 0xffff800038bfdc58 (378352) exclusive rwlock vmmaplk r = 0 (0xfffffd806ec1c2e8) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x3ea sys/kern/kern_rwlock.c:316 #2 vm_map_lock_ln+0x12e sys/uvm/uvm_map.c:5227 #3 uvm_map_protect+0xe1 sys/uvm/uvm_map.c:3034 #4 sys_mprotect+0x34c sys/uvm/uvm_mmap.c:590 #5 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579 #6 Xsyscall+0x128 Process 90171 (syz-executor) thread 0xffff800038bfc2b8 (121564) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff8390d388) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1160 #1 __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1 #2 mi_switch+0x4b7 sys/kern/sched_bsd.c:441 #3 yield+0x6a sys/kern/sched_bsd.c:320 #4 malloc+0xe5 sys/kern/kern_malloc.c:174 #5 sys_semop+0x234 sys/kern/sysv_sem.c:564 #6 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0xb08 sys/arch/amd64/amd64/trap.c:579 #7 Xsyscall+0x128 Process 53896 (syz-executor) thread 0xffff8000ffffd488 (406493) exclusive rrwlock inode r = 0 (0xfffffd806ea24548) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x3ea sys/kern/kern_rwlock.c:316 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:616 #3 VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527 #4 ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline] #4 ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:159 #5 ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1230 #6 ffs_inode_alloc+0x283 sys/ufs/ffs/ffs_alloc.c:393 #7 ufs_mkdir+0x113 sys/ufs/ufs/ufs_vnops.c:1112 #8 VOP_MKDIR+0x102 sys/kern/vfs_vops.c:394 #9 domkdirat+0x179 sys/kern/vfs_syscalls.c:3109 #10 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] #10 syscall+0xb08 sys/arch/amd64/amd64/trap.c:579 #11 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffffd806c67af80) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x3ea sys/kern/kern_rwlock.c:316 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:616 #3 VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527 #4 vn_lock+0xa4 sys/kern/vfs_vnops.c:570 #5 vfs_lookup+0x109 sys/kern/vfs_lookup.c:418 #6 namei+0x7aa sys/kern/vfs_lookup.c:250 #7 domkdirat+0x8b sys/kern/vfs_syscalls.c:3094 #8 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] #8 syscall+0xb08 sys/arch/amd64/amd64/trap.c:579 #9 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10245 11126K 12578K 166960K 14159 0 pcb 17 15K 17K 166960K 359 0 rtable 183 9K 10K 166960K 687 0 pf 37 18K 81K 166960K 169 0 ifaddr 36 6K 7K 166960K 116 0 ifgroup 62 2K 2K 166960K 229 0 sysctl 4 1K 9K 166960K 17 0 counters 68 36K 37K 166960K 198 0 ioctlops 0 0K 4K 166960K 1820 0 iov 0 0K 16K 166960K 116 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1518 95K 96K 166960K 3215 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 9K 166960K 38 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 57 0 dirhash 15 2K 3K 166960K 48 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 17 61K 236K 166960K 1754 0 sigio 1 0K 0K 166960K 27 0 proc 76 103K 128K 166960K 830 0 subproc 72 4K 4K 166960K 117 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 217 0 in_multi 69 4K 7K 166960K 191 0 ether_multi 1 0K 0K 166960K 7 0 mrt 0 0K 0K 166960K 13 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 241 1076K 1076K 166960K 241 0 exec 0 0K 1K 166960K 705 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 5 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 255 161K 175K 166960K 17662 0 UVM aobj 10 2K 2K 166960K 10 0 pinsyscall 42 84K 104K 166960K 3008 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 1K 166960K 119 0 NDP 13 0K 2K 166960K 86 0 temp 79 8684K 8820K 166960K 80770 0 kqueue 13 20K 34K 166960K 306 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 26 0 0 1 0 1 1 0 8 0 rtpcb 120 215 0 212 3 2 1 3 0 8 0 rtentry 176 201 0 127 6 1 5 6 0 8 0 unpcb 144 1519 0 1501 13 12 1 6 0 8 0 syncache 336 10 0 10 5 5 0 1 0 8 0 tcpqe 32 2 21 2 1 0 1 1 0 8 1 tcpcb 808 658 0 648 17 15 2 8 0 8 0 arp 128 37 0 21 1 0 1 1 0 8 0 inpcb 384 2186 0 2169 27 18 9 9 0 8 7 nd6 144 43 0 27 1 0 1 1 0 8 0 pkpcb 40 20 0 20 3 2 1 1 0 8 1 kcovpl 48 13 0 5 1 0 1 1 0 8 0 ppxss 1192 37 0 37 4 3 1 1 0 8 1 pppxif 1504 2 0 2 2 1 1 1 0 8 1 pffrag 232 9 0 1 1 0 1 1 0 482 0 pffrnode 88 9 0 1 1 0 1 1 0 8 0 pffrent 40 12 0 3 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfanchor 1288 1 0 0 1 0 1 1 0 8 0 pftag 88 2 0 0 1 0 1 1 0 8 0 pfstitem 24 102 0 57 1 0 1 1 0 8 0 pfstkey 128 102 0 57 2 0 2 2 0 8 0 pfstate 384 102 0 57 6 0 6 6 0 8 0 pfrule 1344 26 0 18 2 1 1 2 0 8 0 rttmr 136 3 0 3 3 3 0 1 0 8 0 art_heap8 4096 2 0 0 2 0 2 2 0 8 0 art_heap4 256 801 0 482 33 9 24 29 0 8 0 art_table 32 803 0 482 4 0 4 4 0 8 0 art_node 16 192 0 128 1 0 1 1 0 8 0 sysvmsgpl 40 43 0 3 1 0 1 1 0 8 0 semupl 112 1 0 1 1 1 0 1 0 8 0 semapl 112 50 0 41 1 0 1 1 0 8 0 shmpl 112 7 0 0 1 0 1 1 0 8 0 dirhash 1024 41 0 22 3 0 3 3 0 8 0 dino2pl 256 4714 0 3208 95 0 95 95 0 8 0 ffsino 288 4714 0 3208 109 0 109 109 0 8 0 nchpl 144 7199 0 6591 64 39 25 64 0 8 0 rtmask 32 8 0 8 5 5 0 1 0 8 0 uvmvnodes 80 5842 0 0 120 0 120 120 0 8 0 vnodes 216 5842 0 0 325 0 325 325 0 8 0 namei 1024 26194 0 26192 1 0 1 1 0 8 0 percpumem 16 114 0 65 1 0 1 1 0 8 0 kstatmem 264 126 0 94 3 0 3 3 0 8 0 scsiplug 72 9 0 9 4 4 0 1 0 8 0 scxspl 216 24887 0 24887 12 11 1 8 1 8 1 plimitpl 152 587 0 570 1 0 1 1 0 8 0 sigapl 424 2058 0 1988 10 1 9 9 0 8 0 knotepl 120 570 0 0 17 0 17 17 0 8 0 kqueuepl 224 673 0 663 8 6 2 3 0 8 1 pipepl 336 233 0 203 3 0 3 3 0 8 0 fdescpl 520 2016 0 1985 3 0 3 3 0 8 0 filepl 160 14846 0 14616 28 15 13 18 0 8 0 lockfpl 104 660 0 658 2 1 1 2 0 8 0 lockfspl 48 258 0 256 1 0 1 1 0 8 0 sessionpl 144 35 0 26 1 0 1 1 0 8 0 pgrppl 48 70 0 53 1 0 1 1 0 8 0 ucredpl 104 2378 0 2363 1 0 1 1 0 8 0 zombiepl 144 2894 0 2893 1 0 1 1 0 8 0 processpl 1208 2058 0 1988 6 0 6 6 0 8 0 procpl 656 4724 0 4645 8 0 8 8 0 8 0 srpgc 96 18 0 18 5 5 0 1 0 8 0 sockpl 728 3994 0 3956 52 42 10 22 0 8 5 mcl64k 65536 3 0 0 1 0 1 1 0 8 0 mcl16k 16384 2 0 0 1 0 1 1 0 8 0 mcl12k 12288 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 3 0 0 1 0 1 1 0 8 0 mcl4k 4096 121 0 0 15 0 15 15 0 8 0 mcl2k2 2112 2 0 0 1 0 1 1 0 8 0 mcl2k 2048 31 0 0 4 0 4 4 0 8 0 mtagpl 96 31 0 0 1 0 1 1 0 8 0 mbufpl 256 1173 0 0 74 0 74 74 0 8 0 bufpl 280 8385 0 2243 439 0 439 439 0 8 0 anonpl 32 12721 0 0 104 1 103 103 0 246 0 amapchunkpl 152 58412 0 57778 45 13 32 32 0 158 3 amappl16 200 5649 0 5450 44 21 23 25 0 8 0 amappl15 192 9 0 9 2 2 0 1 0 8 0 amappl14 184 142 0 129 1 0 1 1 0 8 0 amappl13 176 2 0 2 1 1 0 1 0 8 0 amappl12 168 2756 0 2725 3 1 2 2 0 8 0 amappl11 160 53 0 39 1 0 1 1 0 8 0 amappl10 152 28 0 28 1 1 0 1 0 8 0 amappl9 144 258 0 257 2 1 1 1 0 8 0 amappl8 136 23 0 20 1 0 1 1 0 8 0 amappl7 128 132 0 119 1 0 1 1 0 8 0 amappl6 120 238 0 235 1 0 1 1 0 8 0 amappl5 112 143 0 132 1 0 1 1 0 8 0 amappl4 104 371 0 350 1 0 1 1 0 8 0 amappl3 96 12015 0 11894 4 0 4 4 0 8 0 amappl2 88 776 0 714 2 0 2 2 0 8 0 amappl1 80 17015 0 16413 16 1 15 15 0 8 0 amappl 88 16535 0 16352 5 0 5 5 0 92 0 dma8192 8192 1 0 1 1 1 0 1 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma2048 2048 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma512 512 2 0 2 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 258 0 258 4 4 0 1 0 8 0 dma64 64 8 0 8 2 2 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 9 0 0 1 0 1 1 0 8 0 uaddrrnd 24 2016 0 1985 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 2016 0 1985 1 0 1 1 0 8 0 vmmpekpl 168 16549 0 16488 3 0 3 3 0 8 0 vmmpepl 168 132179 0 129980 125 16 109 110 0 357 0 vmsppl 480 2015 0 1985 5 0 5 5 0 8 0 rwobjpl 72 41075 0 34092 128 0 128 128 0 8 0 pdppl 4096 4040 0 3970 122 50 72 86 0 8 2 pvpl 32 19314 0 0 156 0 156 156 0 265 0 pmappl 256 2015 0 1985 3 0 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 495 0 84 13 0 13 13 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace sys_semop(ffff800038bfc2b8,ffff80003c457640,ffff80003c457590) at sys_semop+0x45b sys/kern/sysv_sem.c:615 syscall(ffff80003c457640) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c457640) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:579 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x17e8aaf39c0, count: -3 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp ddb{1}> trace x86_ipi_db(ffff8000299ddff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 acpicpu_idle() at acpicpu_idle+0x41e sys/dev/acpi/acpicpu.c:1218 sched_idle(ffff8000299ddff0) at sched_idle+0x4f8 sys/kern/kern_sched.c:182 end trace frame: 0x0, count: -5