AFAIK this is how fork() is implemented in SUA, but I haven't tried it myself. You could load the SUA subsystem dll into IDA Pro and see how they actually do it.

I believe the POSIX subsystem has some kind of support from the native API that prevents you from writing your own random subsystem and expecting it to work; I don't remember what it was though (it's been a few years).

There's some special handling when loading the image where it does different things depending on the value of the subsystem field, but I don't know whether there's any special handling in the kernel that can't be duplicated by using the native api. But the NT kernel does very little when it comes to initializing new processes, most of the initialization is done in user space by ntdll, so it seems unlikely.

Anyways the cygwin guys claim to have forked processes with ZwCreateProcess, but just had problems with getting it to work with the win32 subsystem: http://www.cygwin.com/ml/cygwin-developers/2011-04/msg00034....

Also this guy seems to have managed to do it: http://stackoverflow.com/questions/10657699/cant-use-createp..., but it hang when he called a win32 function (CreateProcess) from the child.

> had problems with getting it to work with the win32 subsystem

Keep in mind that the whole _point_ of Cygwin is to interact with the Windows world. If you want a POSIX sandbox, you can use a VM with fewer headaches and better performance.