The Intel Software Development Manual says this about the neg instruction:
The CF flag set to 0 if the source operand is 0; otherwise it is set to 1. The OF, SF, ZF, AF, and PF flags are set according to the result.
I thought that AF and CF would be set as if neg %eax were replaced by,
not %eax # bitwise negation
add $1, %eax
But that's not the case, negating 0x6ffffef5 on a real CPU sets AF and CF.