The user side of mmap is defined like this: void *mmap(void *addr, size_t length, int prot, int flags, int fd, off_t offset); The kernel side is defined like this: long sys_mmap(unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, unsigned long fd, unsigned long off) Notice that on the user side, 'fd' is a signed integer, while on the kernel side it is an unsigned long. The mmap manpage says this about the MAP_ANONYMOUS flag: MAP_ANONYMOUS The mapping is not backed by any file; its contents are initial- ized to zero. The fd and offset arguments are ignored; however, some implementations require fd to be -1 if MAP_ANONYMOUS (or MAP_ANON) is specified, and portable applications should ensure this. Here's the problem. When MAP_ANONYMOUS is used and fd is set to -1, the syscall.mmap probe treats $fd as an unsigned long, so -1 looks like 4294967295 (on x86_64).
Fixed in commit d945a07.