GenerateConsoleCtrlEvent creates "zombie" process handle in conhost.exe

• Windows build number: 10.0.17763.195

• What you're doing and what's happening: I have an application that starts and stops many sub processes. We use 'GenerateConsoleCtrlEvent' to stop sub processes. Every time we use this function, the conhost.exe process associated with our main / parent process acquires a "zombie" process handle to the stopped sub process.

Here is sample code illustrating the issue which opens notepad, sends a Ctrl-C signal, and then terminates it:

#include <Windows.h>

int main(int argc, char *argv[])
{
    STARTUPINFO startInfo;
    PROCESS_INFORMATION processInfo;
    ZeroMemory(&startInfo, sizeof(startInfo));
    startInfo.cb = sizeof(startInfo);
    ZeroMemory(&processInfo, sizeof(processInfo));

    WCHAR *f = L"c:\\windows\\notepad.exe";

    BOOL bres = CreateProcess(f, nullptr, nullptr, nullptr, FALSE, CREATE_NEW_PROCESS_GROUP, nullptr, nullptr, &startInfo, &processInfo);

    DWORD  dw = GenerateConsoleCtrlEvent(CTRL_C_EVENT, processInfo.dwProcessId);

    TerminateProcess(processInfo.hProcess, 0);

    DWORD status = WaitForSingleObject(processInfo.hProcess, INFINITE);

    CloseHandle(processInfo.hProcess);
    CloseHandle(processInfo.hThread);

    // Observe zombie process handle in Process Explorer, owned by conhost.exe process associated with this process

    Sleep(1000 * 60 * 2);

    return 0;
}

If we open Process Explorer and view the handles owned by the conhost.exe process associated with the sample program ("Sandbox.exe" in my case):

We see that there is a "zombie" process handle to the terminated notepad process:

If you step through the sample code, you can see that the process handle is opened on the call to 'GenerateConsoleCtrlEvent'.

• What's wrong / what should be happening instead: 'GenerateConsoleCtrlEvent' should not leave an open process handle to the target process after invocation.

Start with the provided C++ reproduction and the GenerateConsoleCtrlEvent call, then use Process Explorer to verify the handle behavior in conhost.exe. Done means terminating the sample process no longer leaves a process handle to the stopped child in the associated conhost.exe process.