Here is a simple query that outputs all tunnel=culvert crossing highway=* in the bounding box:
https://overpass-turbo.eu/s/1S08
I didn’t use layer=-1, because it is not seldom missing like PHerison said.
With layer=-1 it would be
https://overpass-turbo.eu/s/1S0a