panic: kernel diagnostic assertion "sc->sc_dev == 0" failed: file "/syzkaller/managers/multicore/kernel/sys/net/if_tun.c", line 322 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *420877 52697 0 0x2 0 0K ifconfig 192887 13788 77 0x100012 0 1 dhcpleased db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830f3f4b) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff830a7f95,ffffffff8307c7c0,142,ffffffff83085ec4) at __assert+0x29 tun_clone_destroy(ffff8000012c6800) at tun_clone_destroy+0x38a sys/net/if_tun.c:322 if_clone_destroy(ffff8000371cb440) at if_clone_destroy+0x1d7 sys/net/if.c:1382 ifioctl(ffff8000013f1cc0,80206979,ffff8000371cb440,ffff80003379d6f0) at ifioctl+0x5c5 sys_ioctl(ffff80003379d6f0,ffff8000371cb620,ffff8000371cb570) at sys_ioctl+0x67c syscall(ffff8000371cb620) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:178 [inline] syscall(ffff8000371cb620) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x70ce23ea5d30, count: 6 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: kernel diagnostic assertion "sc->sc_dev == 0" failed: file "/syzkaller/managers/multicore/kernel/sys/net/if_tun.c", line 322 ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830f3f4b) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff830a7f95,ffffffff8307c7c0,142,ffffffff83085ec4) at __assert+0x29 tun_clone_destroy(ffff8000012c6800) at tun_clone_destroy+0x38a sys/net/if_tun.c:322 if_clone_destroy(ffff8000371cb440) at if_clone_destroy+0x1d7 sys/net/if.c:1382 ifioctl(ffff8000013f1cc0,80206979,ffff8000371cb440,ffff80003379d6f0) at ifioctl+0x5c5 sys_ioctl(ffff80003379d6f0,ffff8000371cb620,ffff8000371cb570) at sys_ioctl+0x67c syscall(ffff8000371cb620) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:178 [inline] syscall(ffff8000371cb620) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x70ce23ea5d30, count: -9 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff8000371cb1f0 rbx 0xffffffff834a0dbf cpu_info_full_primary+0x2dbf rdx 0 rcx 0xffff80003379d6f0 rax 0xffffffff8349fff0 cpu_info_full_primary+0x1ff0 r8 0 r9 0x8080808080808080 r10 0xd1ed4f38417fcfa8 r11 0xe9d03d20e58e2565 r12 0xffffffff834a0bc0 cpu_info_full_primary+0x2bc0 r13 0 r14 0 r15 0x1 rip 0xffffffff81610e15 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff8000371cb1e0 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{0}> show proc PROC (ifconfig) tid=420877 pid=52697 tcnt=1 stat=onproc flags process=2 proc=0 runpri=50, usrpri=50, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80003379c7c0,0xffffffff835f1e20 process=0xffff8000371b31f8 user=0xffff8000371c6000, vmspace=0xfffffd806eea7708 estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=1, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND *52697 420877 31652 0 7 0x2 ifconfig 35065 171334 64554 0 2 0 syz-executor 35065 259708 64554 0 2 0x4000080 syz-executor 34832 76150 89712 0 2 0 syz-executor 34832 47366 89712 0 3 0x4000080 fsleep syz-executor 6552 317302 64799 0 2 0 syz-executor 6552 501761 64799 0 3 0x4000080 fsleep syz-executor 6552 510839 64799 0 3 0x4000080 fsleep syz-executor 6552 491717 64799 0 3 0x4000080 fsleep syz-executor 31652 299852 60770 0 3 0x10008a sigsusp sh 60770 97463 35503 0 3 0x82 wait syz-executor 71842 302567 75129 0 2 0x480 syz-executor 71842 295842 75129 0 3 0x4000080 kqpoll syz-executor 71842 507260 75129 0 3 0x4000080 fsleep syz-executor 71842 69923 75129 0 3 0x4000080 fsleep syz-executor 47934 179678 70200 0 3 0x80 nanoslp syz-executor 47934 163961 70200 0 3 0x4000080 msgwait syz-executor 47934 227833 70200 0 3 0x4000080 fsleep syz-executor 47934 184648 70200 0 3 0x4000080 fsleep syz-executor 48571 87948 0 0 3 0x14200 acct acct 23043 46636 1 0 3 0x100083 ttyin getty 78083 385402 0 0 3 0x14200 bored sosplice 42809 360647 35503 0 2 0x2 syz-executor 64799 514993 35503 0 2 0x482 syz-executor 89712 467010 35503 0 2 0x482 syz-executor 73968 349768 35503 0 3 0x82 wait syz-executor 70200 173805 35503 0 2 0x482 syz-executor 64554 287850 35503 0 3 0x82 nanoslp syz-executor 75129 95114 35503 0 3 0x82 nanoslp syz-executor 35503 468303 55537 0 3 0x82 kqread syz-executor 55537 270992 21120 0 3 0x10008a sigsusp ksh 21120 75406 25534 0 3 0x98 kqread sshd-session 25534 391515 62105 0 3 0x92 kqread sshd-session 62105 308320 1 0 3 0x88 kqread sshd 61924 424064 60516 74 3 0x1100092 bpf pflogd 60516 433452 1 0 3 0x80 sbwait pflogd 36928 426494 72003 73 3 0x1100090 kqread syslogd 72003 67888 1 0 3 0x100082 sbwait syslogd 98861 106183 1 0 3 0x100080 kqread resolvd 13788 192887 8625 77 7 0x100012 dhcpleased 57435 460920 8625 77 3 0x100092 kqread dhcpleased 8625 67189 1 0 3 0x80 kqread dhcpleased 71225 417697 0 0 3 0x14200 bored smr 73325 262265 0 0 2 0x14200 zerothread 29751 260504 0 0 3 0x14200 aiodoned aiodoned 6505 77116 0 0 3 0x14200 syncer update 53177 234051 0 0 3 0x14200 cleaner cleaner 61985 40274 0 0 3 0x14200 reaper reaper 44390 427909 0 0 3 0x14200 pgdaemon pagedaemon 38905 508352 0 0 3 0x14200 bored viomb 85768 424115 0 0 3 0x40014200 acpi0 acpi0 30034 494775 0 0 3 0x40014200 idle1 84915 296097 0 0 3 0x14200 bored softnet3 55833 106215 0 0 3 0x14200 bored softnet2 4992 394791 0 0 3 0x14200 bored softnet1 36446 106610 0 0 2 0x14200 softnet0 66266 391973 0 0 3 0x14200 bored systqmp 2984 184597 0 0 3 0x14200 bored systq 39353 170095 0 0 3 0x14200 tmoslp softclockmp 55635 102179 0 0 2 0x40014200 softclock 97300 469431 0 0 3 0x40014200 idle0 1 372223 0 0 3 0x80082 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks Process 52697 (ifconfig) thread 0xffff80003379d6f0 (420877) exclusive rwlock clonelk r = 0 (0xffffffff83485e90) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 if_clone_destroy+0x67 #2 ifioctl+0x5c5 #3 sys_ioctl+0x67c #4 syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:178 [inline] #4 syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 #5 Xsyscall+0x128 exclusive kernel_lock &kernel_lock r = 0 (0xffffffff8359d538) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 ifioctl+0x5b4 sys/net/if.c:2059 #2 sys_ioctl+0x67c #3 syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:178 [inline] #3 syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 #4 Xsyscall+0x128 Process 13788 (dhcpleased) thread 0xffff8000ffffccb8 (192887) exclusive rwlock sysctllk r = 0 (0xffffffff834562b0) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 rw_enter+0x41b sys/kern/kern_rwlock.c:309 #2 sysctl_vslock+0x45 sys/kern/kern_sysctl.c:181 #3 net_sysctl+0x5a1 sys/kern/uipc_domain.c:245 #4 sys_sysctl+0x425 #5 syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:178 [inline] #5 syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 #6 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10195 11191K 11992K 166960K 12470 0 pcb 18 14K 16K 166960K 226 0 rtable 163 5K 7K 166960K 423 0 pf 33 17K 18K 166960K 81 0 ifaddr 34 5K 7K 166960K 66 0 ifgroup 51 2K 2K 166960K 102 0 sysctl 2 0K 0K 166960K 4 0 counters 62 36K 36K 166960K 92 0 ioctlops 0 0K 4K 166960K 1537 0 iov 0 0K 16K 166960K 58 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1456 92K 92K 166960K 2119 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 3 5K 9K 166960K 16 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 25 0 dirhash 12 2K 2K 166960K 36 0 ACPI 1690 195K 286K 166960K 12468 0 file desc 19 69K 89K 166960K 887 0 sigio 0 0K 0K 166960K 15 0 proc 79 103K 128K 166960K 615 0 subproc 104 6K 6K 166960K 117 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 143 0 in_multi 75 5K 7K 166960K 136 0 ether_multi 1 0K 0K 166960K 9 0 mrt 1 0K 0K 166960K 6 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 103 466K 466K 166960K 103 0 exec 0 0K 1K 166960K 532 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 257 73K 87K 166960K 9948 0 UVM aobj 5 2K 2K 166960K 5 0 pinsyscall 44 88K 101K 166960K 1999 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 46 0 NDP 11 0K 2K 166960K 45 0 temp 51 6821K 6949K 166960K 24720 0 kqueue 14 22K 31K 166960K 164 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 24 0 0 1 0 1 1 0 8 0 rtpcb 120 110 0 107 2 1 1 2 0 8 0 rtentry 112 131 0 58 4 0 4 4 0 8 0 unpcb 144 898 0 880 6 0 6 6 0 8 5 syncache 336 11 0 11 2 1 1 1 0 8 1 tcpqe 32 1 0 1 1 0 1 1 0 8 1 tcpcb 808 368 0 330 4 0 4 4 0 8 0 arp 120 23 0 11 1 0 1 1 0 8 0 inpcb 336 1259 0 1181 16 9 7 12 0 8 0 nd6 136 29 0 10 1 0 1 1 0 8 0 pkpcb 40 3 0 3 2 2 0 1 0 8 0 kcovpl 48 9 0 1 1 0 1 1 0 8 0 ppxss 1168 6 0 6 2 1 1 1 0 8 1 pffrag 232 11 0 4 1 0 1 1 0 482 0 pffrnode 88 10 0 4 1 0 1 1 0 8 0 pffrent 40 19 0 12 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 81 0 20 1 0 1 1 0 8 0 pfstkey 128 81 0 20 2 0 2 2 0 8 0 pfstate 376 81 0 20 7 0 7 7 0 8 0 pfrule 1344 21 0 15 2 0 2 2 0 8 0 art_heap8 4096 2 0 0 2 0 2 2 0 8 0 art_heap4 256 541 0 185 30 1 29 30 0 8 4 art_table 32 543 0 185 4 0 4 4 0 8 0 art_node 16 129 0 65 1 0 1 1 0 8 0 sysvmsgpl 40 9 0 2 1 0 1 1 0 8 0 semupl 112 1 0 1 1 1 0 1 0 8 0 semapl 112 22 0 12 1 0 1 1 0 8 0 shmpl 112 2 0 0 1 0 1 1 0 8 0 dirhash 1024 33 0 16 3 0 3 3 0 8 0 dino2pl 256 2984 0 1482 95 0 95 95 0 8 0 ffsino 272 2984 0 1482 101 0 101 101 0 8 0 nchpl 144 4269 0 2583 63 0 63 63 0 8 0 uvmvnodes 80 3534 0 0 73 0 73 73 0 8 0 vnodes 216 3534 0 0 197 0 197 197 0 8 0 namei 1024 15344 0 15344 3 1 2 2 0 8 2 percpumem 16 60 0 15 1 0 1 1 0 8 0 kstatmem 264 52 0 30 2 0 2 2 0 8 0 scsiplug 72 9 0 9 2 2 0 1 0 8 0 scxspl 216 12606 0 12606 10 8 2 8 1 8 2 plimitpl 152 111 0 94 1 0 1 1 0 8 0 sigapl 424 1194 0 1141 8 2 6 7 0 8 0 futexpl 64 12042 0 12034 1 0 1 1 0 8 0 knotepl 120 571 0 0 18 0 18 18 0 8 0 kqueuepl 216 231 0 221 2 1 1 2 0 8 0 pipepl 320 242 0 214 8 0 8 8 0 8 5 fdescpl 496 1173 0 1140 5 0 5 5 0 8 0 filepl 152 8276 0 7957 25 4 21 21 0 8 8 lockfpl 104 511 0 509 3 1 2 2 0 8 1 lockfspl 48 104 0 102 1 0 1 1 0 8 0 sessionpl 144 31 0 22 1 0 1 1 0 8 0 pgrppl 48 113 0 96 1 0 1 1 0 8 0 ucredpl 104 1140 0 1127 1 0 1 1 0 8 0 zombiepl 144 1143 0 1141 1 0 1 1 0 8 0 processpl 1160 1194 0 1141 5 1 4 5 0 8 0 procpl 648 2466 0 2402 8 1 7 7 0 8 1 srpgc 96 12 0 12 1 0 1 1 0 8 1 sosppl 168 2 0 2 1 0 1 1 0 8 1 sockpl 664 2286 0 2189 24 13 11 14 0 8 2 mcl64k 65536 4 0 0 1 0 1 1 0 8 0 mcl12k 12288 1 0 0 1 0 1 1 0 8 0 mcl9k 9216 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 4 0 0 1 0 1 1 0 8 0 mcl4k 4096 140 0 0 18 0 18 18 0 8 0 mcl2k 2048 28 0 0 4 0 4 4 0 8 0 mtagpl 96 20 0 0 1 0 1 1 0 8 0 mbufpl 256 289 0 0 18 0 18 18 0 8 0 bufpl 280 3959 0 103 276 0 276 276 0 8 0 anonpl 24 214280 0 209678 55 6 49 49 0 185 19 amapchunkpl 152 34025 0 33412 28 0 28 28 0 158 4 amappl16 200 5163 0 5131 32 19 13 15 0 8 8 amappl15 192 23 0 23 2 2 0 1 0 8 0 amappl14 184 126 0 114 1 0 1 1 0 8 0 amappl13 176 72 0 72 2 2 0 1 0 8 0 amappl12 168 1829 0 1796 4 1 3 3 0 8 0 amappl11 160 51 0 37 1 0 1 1 0 8 0 amappl10 152 18 0 17 1 0 1 1 0 8 0 amappl9 144 163 0 162 1 0 1 1 0 8 0 amappl8 136 33 0 30 1 0 1 1 0 8 0 amappl7 128 115 0 103 1 0 1 1 0 8 0 amappl6 120 166 0 163 1 0 1 1 0 8 0 amappl5 112 141 0 125 1 0 1 1 0 8 0 amappl4 104 362 0 342 1 0 1 1 0 8 0 amappl3 96 5947 0 5845 3 0 3 3 0 8 0 amappl2 88 1512 0 1426 3 0 3 3 0 8 0 amappl1 80 11607 0 11028 15 1 14 14 0 8 0 amappl 88 9464 0 9270 5 0 5 5 0 92 0 dma16384 16384 1 0 1 1 1 0 1 0 8 0 dma8192 8192 1 0 1 1 1 0 1 0 8 0 dma4096 4096 2 0 2 2 2 0 1 0 8 0 dma2048 2048 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 255 0 255 3 3 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 4 0 0 1 0 1 1 0 8 0 uaddrrnd 24 1173 0 1140 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 1173 0 1140 1 0 1 1 0 8 0 vmmpekpl 168 11412 0 11374 4 1 3 3 0 8 0 vmmpepl 168 80440 0 78497 105 4 101 101 0 357 12 vmsppl 448 1172 0 1140 6 2 4 5 0 8 0 rwobjpl 56 28519 0 23997 65 0 65 65 0 8 1 pdppl 4096 2353 0 2280 105 32 73 83 0 8 0 pvpl 32 15275 0 0 123 0 123 123 0 265 0 pmappl 248 1172 0 1140 3 0 3 3 0 8 0 extentpl 40 55 0 38 1 0 1 1 0 8 0 phpool 112 418 0 53 11 0 11 11 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830f3f4b) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff830a7f95,ffffffff8307c7c0,142,ffffffff83085ec4) at __assert+0x29 tun_clone_destroy(ffff8000012c6800) at tun_clone_destroy+0x38a sys/net/if_tun.c:322 if_clone_destroy(ffff8000371cb440) at if_clone_destroy+0x1d7 sys/net/if.c:1382 ifioctl(ffff8000013f1cc0,80206979,ffff8000371cb440,ffff80003379d6f0) at ifioctl+0x5c5 sys_ioctl(ffff80003379d6f0,ffff8000371cb620,ffff8000371cb570) at sys_ioctl+0x67c syscall(ffff8000371cb620) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:178 [inline] syscall(ffff8000371cb620) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x70ce23ea5d30, count: -9 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffff800029b7bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff8359d330) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline] __mp_lock(ffffffff8359d330) at __mp_lock+0x192 sys/kern/kern_lock.c:144 sysctl_vslock(0,0) at sysctl_vslock+0x80 sys/kern/kern_sysctl.c:186 net_sysctl(ffff80002a036c24,5,0,ffff80002a036c58,0,0,b078e2ddfc31da87) at net_sysctl+0x5a1 sys/kern/uipc_domain.c:245 sys_sysctl(ffff8000ffffccb8,ffff80002a036d90,ffff80002a036ce0) at sys_sysctl+0x425 syscall(ffff80002a036d90) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:178 [inline] syscall(ffff80002a036d90) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7b63703c4390, count: 6 ddb{1}> trace x86_ipi_db(ffff800029b7bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff8359d330) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline] __mp_lock(ffffffff8359d330) at __mp_lock+0x192 sys/kern/kern_lock.c:144 sysctl_vslock(0,0) at sysctl_vslock+0x80 sys/kern/kern_sysctl.c:186 net_sysctl(ffff80002a036c24,5,0,ffff80002a036c58,0,0,b078e2ddfc31da87) at net_sysctl+0x5a1 sys/kern/uipc_domain.c:245 sys_sysctl(ffff8000ffffccb8,ffff80002a036d90,ffff80002a036ce0) at sys_sysctl+0x425 syscall(ffff80002a036d90) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:178 [inline] syscall(ffff80002a036d90) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7b63703c4390, count: -9