[okanat]

In the next post they literally tell that NT kernel "supports" it https://learn.microsoft.com/en-gb/archive/blogs/wsl/pico-pro... . In the same post if you scroll down into the comments they also say that their fork implementation

Just because YOU don't have access to the functionality used for fork, it doesn't mean that there are no internal API calls that can do a fork or do something very similar that it is indistinguishable. A ring-0 driver (like lxcore.sys) that can access a non-standard special process model (pico processes) and is allowed to register its own syscall entry/exit points can also access lower level functionality like accessing the page table of a pico process, modifying it and responding to non-Win32 syscalls.

When you run fork in a WSL1 program now, its effects are the same as doing a fork natively on a Linux kernel: the memory space view is cloned as CoW, a new stack is allocated and the execution is resumed in both processes. If it forks like a duck, it is a duck.

Yes standard Win32 cannot do forks. However, Win32 isn't the only identity NT can expose and NT provides functionality to do forks. Just not to the normal programmers.

Actually a further research reveals that it is very much possible to trigger forking behavior even from the user space. Here is the proof: https://github.com/mobdk/CloneProcess https://stackoverflow.com/questions/985281/what-is-the-close... . You just need to use ZwCreateProcess.

[0x1d7]

NT does not have a fork-alike API. The NT internal APIs are all known.