yamt@mwd.biglobe.ne.jp said:
> if it's considered a kernel bug, we can fix kernel implementations

I don't think this is realistic. The kernel code used unsigned
all the time, and it was imported into x operating systems.
(I'd say signed would feel a bit more "natural", but then
we would need at least need "signed loads" of bytes/shorts,
or perhaps explicite "sign extend" operations to make it useful.)

> if it was "(-10)/2 == -5", one might think it's natural to
> optimize it to TRUE

Hmm, this would open the way to much more confusion:
"(-10)/2 > -6" would have to be FALSE because comparisions
are explicitely unsigned and documented to be so at all places.
(Well, 2 places I know of: the pcap manpage and the section
about expressions in tcpdump's.)
Imho the only way to be consistent is to state that all
operations are unsigned and that "-X" is just a shortcut
for "~X + 1".

> > bring a discussion on tcpdump-workers
> i'm happy if you just beat me

I might do so... I'm currently planning for next week and
it might well happen that I'm AFK all the time.
It might take some time.

best regards
Matthias