I don't exactly have an answer, but I may be able to shed some light here.

When you use fopen(), you get a stream. But this is built on open() and open() would give you an fd. The fd is a kernel thing and the stream is a library thing built on top on it.

In the same way, a lwp is a kernel thing and a thread (or a pthread) is a library thing.

What I have just discovered this morning is that the lwp's and the threads are not in a one-to-one correspondence.

Look at "man pthread_attr_init". You will see language like 'This thread is not "bound" to a LWP, and is also called an unbound thread.'

I gotta read up on threads sometimes. Since you are trying to count them, maybe you should do the same. In any event, it looks like counting LWP's is not going to help you counting threads.

Here is my guess as to why 3 lwps:

Consider what would happen if you did an fopen(), but all of the fd's were in use. If you had not yet reached the limit on fd's, when the open() system call occurred, the kernel would allocate another chunk of fd's to the process, not just one.

Or if you need more stack, your stack grows by a page, not just the few bytes that you need.

Or if you write another byte to a disk file, the file may grow by a full block.

The kernel may not be easily able to give you just one lwp, or it may just be attempting to be efficient.