difference between tty[p,r,s][N] and pts
OS X, like other UNIX-iod systems, implements two systems of pseudo-terminals: the pty system and the ptmx system (links are to the kernel source used in 10.9.5).

They both ultimately offer the same functionality: they let one program (e.g. a terminal emulator) open (the master side of) a pseudo-terminal and subsequently start other programs (e.g. a shell) running “in” (the slave side of) that same pseudo-terminal.

The pty system is older. The device nodes for the master sides of its pseudo-terminals match the pattern /dev/pty[pqrstuvw][0123456789abcdef]. The slave sides use corresponding nodes named with tty (/dev/tty[pqrstuvw][0123456789abcdef]). These device nodes are allocated when the system starts (i.e. they are always present in /dev/).

The ptmx system is newer and uses a single master device node, /dev/ptmx, and uses /dev/ttys[0-9][0-9][0-9] for the slave sides. The slaves device nodes are dynamically allocated (so only the nodes that are still in use exist in /dev/).

Basically, any program that uses the “modern” pseudo-terminal APIs will automatically end up using ptmx-based pseudo-terminals. Programs using the older pseduo-terminal interfaces will use pty-based pseudo-terminals.



In your case, when spawning its children, your sshd used the newer ptmx system (or an interface like openpty that uses it “under the hood”), but the pertinent ancestor of those root shells used the old pty system. If you are curious, you could trace the parent PIDs (PPID, the third column in your output) to find the ancestor program that spawned the line of processes that ended up running those root shells (the leading hyphen indicates that they are login shells).

Also, other systems may use variations on the device names. Some systems might go beyond 0–f for the pty names, and some systems use /dev/pts/&lt;digits&gt; (i.e. in a subdirectory instead of putting them all in /dev and having to use three digits to avoid conflict with the ttys0–ttys9 slave nodes from the pty system).