panic: kernel diagnostic assertion "sc->sc_dev == 0" failed: file "/syzkaller/managers/setuid/kernel/sys/net/if_tun.c", line 315 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 276748 10697 0 0x2 0 0 sh *294412 20178 0 0x2 0 1K ifconfig db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830e2a3c) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff8309aa14,ffffffff830e2535,13b,ffffffff8307948d) at __assert+0x29 tun_clone_destroy(ffff800001591000) at tun_clone_destroy+0x38a sys/net/if_tun.c:315 if_clone_destroy(ffff8000363dd760) at if_clone_destroy+0x1d7 sys/net/if.c:1384 ifioctl(ffff80000170e2a0,80206979,ffff8000363dd760,ffff800032baf200) at ifioctl+0x5c5 sys_ioctl(ffff800032baf200,ffff8000363dd940,ffff8000363dd890) at sys_ioctl+0x67c syscall(ffff8000363dd940) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline] syscall(ffff8000363dd940) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x79a95d79af00, count: 6 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: kernel diagnostic assertion "sc->sc_dev == 0" failed: file "/syzkaller/managers/setuid/kernel/sys/net/if_tun.c", line 315 ddb{1}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830e2a3c) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff8309aa14,ffffffff830e2535,13b,ffffffff8307948d) at __assert+0x29 tun_clone_destroy(ffff800001591000) at tun_clone_destroy+0x38a sys/net/if_tun.c:315 if_clone_destroy(ffff8000363dd760) at if_clone_destroy+0x1d7 sys/net/if.c:1384 ifioctl(ffff80000170e2a0,80206979,ffff8000363dd760,ffff800032baf200) at ifioctl+0x5c5 sys_ioctl(ffff800032baf200,ffff8000363dd940,ffff8000363dd890) at sys_ioctl+0x67c syscall(ffff8000363dd940) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline] syscall(ffff8000363dd940) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x79a95d79af00, count: -9 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff8000363dd510 rbx 0xffff800029b7cd87 rdx 0 rcx 0xffff800032baf200 rax 0xffff800029b7bff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x7a2715672740f18e r11 0xdea73b7074fc7aa0 r12 0xffff800029b7cb88 r13 0 r14 0 r15 0x1 rip 0xffffffff820f2715 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff8000363dd500 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (ifconfig) tid=294412 pid=20178 tcnt=1 stat=onproc flags process=2 proc=0 runpri=55, usrpri=55, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff8000ffff6528,0xffff800032baea78 process=0xffff800029fe8008 user=0xffff8000363d8000, vmspace=0xfffffd806eb321c0 estcpu=7, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 49403 140154 9508 0 2 0x100000 sh 10697 276748 33807 0 7 0x2 sh *20178 294412 76686 0 7 0x2 ifconfig 35424 437462 88752 0 2 0x100000 sh 76686 108686 54197 0 3 0x10008a sigsusp sh 88752 274967 91676 0 3 0x10008a sigsusp sh 54197 146325 14630 0 3 0x80 wait syz-executor 9508 152707 1604 0 3 0x10008a sigsusp sh 79116 483723 91543 0 2 0x2 sh 10131 287218 7343 0 2 0x100002 arp 7343 503319 44313 0 3 0x10008a sigsusp sh 14630 60827 66647 0 3 0x82 wait syz-executor 90613 198760 91097 32767 2 0x10 syz-executor 90613 80352 91097 32767 3 0x4000090 fsleep syz-executor 90613 86341 91097 32767 3 0x4000090 fsleep syz-executor 11236 400744 83363 32767 2 0x10 syz-executor 11236 375666 83363 32767 3 0x4000090 fsleep syz-executor 11236 498386 83363 32767 3 0x4000090 fsleep syz-executor 91543 9295 54787 0 3 0x80 wait syz-executor 54787 479640 66647 0 3 0x82 wait syz-executor 44313 511300 2443 0 3 0x80 wait syz-executor 91676 94767 9997 0 3 0x80 wait syz-executor 2443 307479 66647 0 3 0x82 wait syz-executor 91097 375801 82688 32767 3 0x90 nanoslp syz-executor 9997 410367 66647 0 3 0x82 wait syz-executor 1604 61991 48321 0 3 0x80 wait syz-executor 83363 247341 8123 32767 3 0x90 nanoslp syz-executor 33807 371006 61029 0 3 0x80 wait syz-executor 48321 222409 66647 0 3 0x82 wait syz-executor 8123 172740 66647 0 3 0x82 wait syz-executor 82688 170197 66647 0 3 0x82 wait syz-executor 61029 157373 66647 0 3 0x82 wait syz-executor 75032 483961 84377 0 2 0x100082 ndp 84377 167062 67454 0 3 0x10008a sigsusp sh 67454 16387 1 0 3 0x80 wait syz-executor 2824 168245 0 0 3 0x14200 bored sosplice 59497 133984 93647 0 2 0x100082 arp 93647 244665 20454 0 3 0x10008a sigsusp sh 20454 252393 1 0 3 0x80 wait syz-executor 66647 3592 66986 0 3 0x82 kqread syz-executor 66986 13962 35653 0 3 0x10008a sigsusp ksh 35653 178607 92176 0 3 0x98 kqread sshd-session 92176 502370 39153 0 3 0x92 kqread sshd-session 77068 219540 1 0 3 0x100083 ttyin getty 39153 357057 1 0 3 0x88 kqread sshd 39030 437182 36728 73 3 0x1100090 kqread syslogd 36728 161058 1 0 3 0x100082 sbwait syslogd 46476 20475 1 0 3 0x100080 kqread resolvd 2120 478104 89347 77 2 0x100092 dhcpleased 6798 19888 89347 77 3 0x100092 kqread dhcpleased 89347 453855 1 0 3 0x80 kqread dhcpleased 57945 442292 0 0 3 0x14200 bored smr 89215 500337 0 0 2 0x14200 zerothread 38227 206473 0 0 3 0x14200 aiodoned aiodoned 28483 520503 0 0 3 0x14200 syncer update 36160 426877 0 0 3 0x14200 cleaner cleaner 29501 173871 0 0 3 0x14200 reaper reaper 84039 262688 0 0 3 0x14200 pgdaemon pagedaemon 30508 206484 0 0 3 0x14200 bored viomb 39398 356166 0 0 3 0x40014200 acpi0 acpi0 12230 326018 0 0 3 0x40014200 idle1 13590 348522 0 0 3 0x14200 bored softnet3 1112 241202 0 0 3 0x14200 bored softnet2 98653 376564 0 0 3 0x14200 bored softnet1 35863 351714 0 0 3 0x14200 bored softnet0 32553 389449 0 0 3 0x14200 bored systqmp 59968 500475 0 0 3 0x14200 bored systq 96128 345671 0 0 3 0x14200 tmoslp softclockmp 34993 400189 0 0 3 0x40014200 tmoslp softclock 10994 40735 0 0 3 0x40014200 idle0 1 158229 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{1}> show all locks Process 20178 (ifconfig) thread 0xffff800032baf200 (294412) exclusive rwlock clonelk r = 0 (0xffffffff8347ed30) #0 witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5b8 sys/kern/subr_witness.c:1151 #1 if_clone_destroy+0x67 #2 ifioctl+0x5c5 #3 sys_ioctl+0x67c #4 syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline] #4 syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 #5 Xsyscall+0x128 exclusive kernel_lock &kernel_lock r = 0 (0xffffffff835a4fd0) #0 witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5b8 sys/kern/subr_witness.c:1151 #1 ifioctl+0x5b4 sys/net/if.c:2061 #2 sys_ioctl+0x67c #3 syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline] #3 syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 #4 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10223 14124K 14131K 166960K 12956 0 pcb 17 22K 26K 166960K 25 0 rtable 178 5K 7K 166960K 18570 0 pf 31 16K 16K 166960K 1148 0 ifaddr 35 13K 18K 166960K 2245 0 ifgroup 50 2K 2K 166960K 2269 0 sysctl 4 1K 5K 166960K 48 0 counters 64 36K 36K 166960K 1166 0 ioctlops 0 0K 2K 166960K 1081 0 iov 0 0K 24K 166960K 2060 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1484 93K 93K 166960K 14322 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 13K 166960K 455 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 1K 166960K 884 0 dirhash 21 4K 5K 166960K 645 0 ACPI 1690 195K 286K 166960K 12418 0 file desc 37 138K 186K 166960K 28127 0 sigio 0 0K 0K 166960K 798 0 proc 65 91K 176K 166960K 18186 0 subproc 130 8K 13K 166960K 9087 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 5399 0 in_multi 68 5K 7K 166960K 7140 0 ether_multi 1 0K 0K 166960K 194 0 mrt 1 0K 0K 166960K 7 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 277 1235K 1235K 166960K 277 0 exec 0 0K 1K 166960K 11534 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 269 91K 148K 166960K 230891 0 UVM aobj 131 4K 8K 166960K 137 0 pinsyscall 60 120K 150K 166960K 44264 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 1K 166960K 1802 0 NDP 21 1K 2K 166960K 1667 0 temp 83 6824K 6952K 166960K 172140 0 kqueue 13 20K 35K 166960K 4000 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 24 0 0 1 0 1 1 0 8 0 rtpcb 120 4634 0 4628 31 30 1 4 0 8 0 rtentry 112 6388 0 6306 16 12 4 4 0 8 1 unpcb 144 25274 0 25257 158 157 1 19 0 8 0 syncache 336 466 0 466 39 38 1 1 0 8 1 tcpqe 32 245 0 245 35 35 0 1 0 8 0 tcpcb 808 17018 0 16947 230 216 14 22 0 8 1 arp 120 1128 0 1113 1 0 1 1 0 8 0 ipq 40 109 0 107 7 6 1 1 0 8 0 ipqe 40 1658 0 1656 7 6 1 1 0 8 0 inpcb 336 37318 0 37243 249 237 12 21 0 8 0 ip6q 72 4 0 4 4 4 0 1 0 8 0 ip6af 40 7 0 7 4 4 0 1 0 8 0 nd6 136 1915 0 1902 9 8 1 2 0 8 0 kcovpl 48 699 0 689 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 25864 0 25532 186 158 28 32 0 8 7 art_table 32 25865 0 25532 7 3 4 5 0 8 1 art_node 16 6387 0 6312 1 0 1 1 0 8 0 sysvmsgpl 40 17 0 13 2 1 1 1 0 8 0 semapl 112 882 0 872 1 0 1 1 0 8 0 shmpl 112 134 0 6 4 0 4 4 0 8 0 dirhash 1024 454 0 423 13 8 5 5 0 8 1 dino2pl 256 33705 0 30379 212 3 209 209 0 8 0 ffsino 272 33705 0 30379 226 3 223 223 0 8 0 nchpl 144 61110 0 58047 114 0 114 114 0 8 0 uvmvnodes 80 10342 0 0 212 0 212 212 0 8 0 vnodes 216 10342 0 0 575 0 575 575 0 8 0 namei 1024 282391 0 282391 48 46 2 2 0 8 2 percpumem 16 597 0 551 1 0 1 1 0 8 0 kstatmem 264 1124 0 1102 3 1 2 2 0 8 0 scxspl 216 343991 0 343991 70 69 1 8 1 8 1 plimitpl 152 8698 0 8672 2 0 2 2 0 8 0 sigapl 424 27187 0 27120 12 3 9 9 0 8 0 futexpl 64 296650 0 296646 30 29 1 1 0 8 0 knotepl 120 1546 0 0 18 0 18 18 0 8 0 kqueuepl 216 8892 0 8883 90 89 1 9 0 8 0 pipepl 320 5547 0 5514 47 42 5 9 0 8 0 fdescpl 496 27168 0 27120 29 21 8 8 0 8 0 filepl 152 190396 0 190123 166 151 15 29 0 8 0 lockfpl 104 7238 0 7236 6 5 1 2 0 8 0 lockfspl 48 1903 0 1901 1 0 1 1 0 8 0 sessionpl 144 760 0 742 2 0 2 2 0 8 0 pgrppl 48 2043 0 2017 1 0 1 1 0 8 0 ucredpl 104 36945 0 36932 1 0 1 1 0 8 0 zombiepl 144 27120 0 27120 1 0 1 1 0 8 1 processpl 1160 27187 0 27120 6 0 6 6 0 8 0 procpl 648 60264 0 60193 10 2 8 8 0 8 0 srpgc 96 47 0 45 17 16 1 1 0 8 0 sosppl 168 320 0 316 34 33 1 1 0 8 0 sockpl 664 67760 0 67661 390 374 16 44 0 8 0 mcl64k 65536 21 0 0 3 0 3 3 0 8 0 mcl16k 16384 7 0 0 1 0 1 1 0 8 0 mcl12k 12288 2 0 0 1 0 1 1 0 8 0 mcl9k 9216 3 0 0 1 0 1 1 0 8 0 mcl8k 8192 19 0 0 3 0 3 3 0 8 0 mcl4k 4096 6 0 0 1 0 1 1 0 8 0 mcl2k2 2112 2 0 0 1 0 1 1 0 8 0 mcl2k 2048 690 0 0 31 12 19 31 0 8 0 mtagpl 96 10 0 0 1 0 1 1 0 8 0 mbufpl 256 4884 0 0 270 0 270 270 0 8 0 bufpl 280 46752 0 36407 740 0 740 740 0 8 0 anonpl 24 3326182 0 3319739 335 269 66 90 0 185 1 amapchunkpl 152 752156 0 751505 210 175 35 48 0 158 4 amappl16 200 72193 0 72153 584 571 13 29 0 8 8 amappl15 192 16 0 16 6 6 0 1 0 8 0 amappl14 184 1595 0 1582 4 3 1 2 0 8 0 amappl13 176 99 0 99 24 24 0 1 0 8 0 amappl12 168 36808 0 36760 3 0 3 3 0 8 0 amappl11 160 58 0 47 1 0 1 1 0 8 0 amappl10 152 12 0 12 2 2 0 1 0 8 0 amappl9 144 129 0 128 2 1 1 1 0 8 0 amappl8 136 22 0 20 1 0 1 1 0 8 0 amappl7 128 1376 0 1361 1 0 1 1 0 8 0 amappl6 120 5639 0 5628 1 0 1 1 0 8 0 amappl5 112 2583 0 2572 1 0 1 1 0 8 0 amappl4 104 2731 0 2711 1 0 1 1 0 8 0 amappl3 96 151640 0 151524 9 4 5 5 0 8 0 amappl2 88 10613 0 10534 5 2 3 4 0 8 0 amappl1 80 171665 0 171033 46 25 21 29 0 8 0 amappl 88 223910 0 223705 8 1 7 7 0 92 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 136 0 6 3 0 3 3 0 8 0 uaddrrnd 24 27168 0 27120 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 27168 0 27120 1 0 1 1 0 8 0 vmmpekpl 168 243359 0 243285 6 2 4 5 0 8 0 vmmpepl 168 1676754 0 1674523 382 262 120 162 0 357 10 vmsppl 440 27167 0 27120 28 21 7 7 0 8 0 rwobjpl 56 451943 0 440391 195 26 169 172 0 8 0 pdppl 4096 54343 0 54240 1590 1475 115 127 0 8 12 pvpl 32 47566 0 0 377 0 377 377 0 265 0 pmappl 248 27167 0 27120 5 1 4 4 0 8 0 extentpl 40 56 0 38 1 0 1 1 0 8 0 phpool 112 3106 0 2198 27 0 27 27 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff8346fff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff835a4dc8) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline] __mp_lock(ffffffff835a4dc8) at __mp_lock+0x192 sys/kern/kern_lock.c:144 softintr_dispatch(0) at softintr_dispatch+0x5b sys/arch/amd64/amd64/softintr.c:88 Xsoftclock() at Xsoftclock+0x27 __mp_lock(ffffffff835a4dc8) at __mp_lock+0x199 __mp_lock_spin sys/kern/kern_lock.c:113 [inline] __mp_lock(ffffffff835a4dc8) at __mp_lock+0x199 sys/kern/kern_lock.c:144 syscall(ffff80002a134950) at syscall+0xad6 mi_syscall sys/sys/syscall_mi.h:179 [inline] syscall(ffff80002a134950) at syscall+0xad6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x79056d9e4920, count: 6 ddb{0}> trace x86_ipi_db(ffffffff8346fff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff835a4dc8) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline] __mp_lock(ffffffff835a4dc8) at __mp_lock+0x192 sys/kern/kern_lock.c:144 softintr_dispatch(0) at softintr_dispatch+0x5b sys/arch/amd64/amd64/softintr.c:88 Xsoftclock() at Xsoftclock+0x27 __mp_lock(ffffffff835a4dc8) at __mp_lock+0x199 __mp_lock_spin sys/kern/kern_lock.c:113 [inline] __mp_lock(ffffffff835a4dc8) at __mp_lock+0x199 sys/kern/kern_lock.c:144 syscall(ffff80002a134950) at syscall+0xad6 mi_syscall sys/sys/syscall_mi.h:179 [inline] syscall(ffff80002a134950) at syscall+0xad6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x79056d9e4920, count: -9 ddb{0}> machine ddbcpu 1 Stopped at db_enter+0x25: addq $0x8,%rsp db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830e2a3c) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff8309aa14,ffffffff830e2535,13b,ffffffff8307948d) at __assert+0x29 tun_clone_destroy(ffff800001591000) at tun_clone_destroy+0x38a sys/net/if_tun.c:315 if_clone_destroy(ffff8000363dd760) at if_clone_destroy+0x1d7 sys/net/if.c:1384 ifioctl(ffff80000170e2a0,80206979,ffff8000363dd760,ffff800032baf200) at ifioctl+0x5c5 sys_ioctl(ffff800032baf200,ffff8000363dd940,ffff8000363dd890) at sys_ioctl+0x67c syscall(ffff8000363dd940) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline] syscall(ffff8000363dd940) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x79a95d79af00, count: 6 ddb{1}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830e2a3c) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff8309aa14,ffffffff830e2535,13b,ffffffff8307948d) at __assert+0x29 tun_clone_destroy(ffff800001591000) at tun_clone_destroy+0x38a sys/net/if_tun.c:315 if_clone_destroy(ffff8000363dd760) at if_clone_destroy+0x1d7 sys/net/if.c:1384 ifioctl(ffff80000170e2a0,80206979,ffff8000363dd760,ffff800032baf200) at ifioctl+0x5c5 sys_ioctl(ffff800032baf200,ffff8000363dd940,ffff8000363dd890) at sys_ioctl+0x67c syscall(ffff8000363dd940) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline] syscall(ffff8000363dd940) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x79a95d79af00, count: -9