gh-159237: Fix buffer type confusion in _winapi.CreateProcess audit event

Lib/test/audit-tests.py

@@ -659,6 +659,22 @@ def hook(event, args):
     _winapi.CreateNamedPipe(pipe_name, _winapi.PIPE_ACCESS_DUPLEX, 8, 2, 0, 0, 0, 0)
 
 
+def test_winapi_createprocess(command_line):
+    import _winapi
+    import subprocess
+
+    def hook(event, args):
+        if event == "_winapi.CreateProcess":
+            print(event, args)
+
+    sys.addaudithook(hook)
+    hp, ht, _, _ = _winapi.CreateProcess(
+        sys.executable, command_line, None, None, False, 0, None, None,
+        subprocess.STARTUPINFO())
+    _winapi.CloseHandle(ht)
+    _winapi.CloseHandle(hp)
+
+
 def test_assert_unicode():
     import sys
     sys.addaudithook(lambda *args: None)

Lib/test/test_audit.py

@@ -319,6 +319,22 @@ def test_winapi_createnamedpipe(self):
 
         self.assertEqual(actual, expected)
 
+    def test_winapi_createprocess(self):
+        winapi = import_helper.import_module("_winapi")
+
+        command_line = "python -c pass"
+        returncode, events, stderr = self.run_python("test_winapi_createprocess", command_line)
+        if returncode:
+            self.fail(stderr)
+
+        if support.verbose:
+            print(*events, sep='\n')
+        actual = [(ev[0], ev[2]) for ev in events]
+        expected = [("_winapi.CreateProcess",
+                     f"({sys.executable!r}, {command_line!r}, None)")]
+
+        self.assertEqual(actual, expected)
+
     def test_assert_unicode(self):
         # See gh-126018
         returncode, _, stderr = self.run_python("test_assert_unicode")

Misc/NEWS.d/next/Windows/2026-10-13-01-22-44.gh-issue-159237.JYm7N8.rst

@@ -0,0 +1,2 @@
+Fix the ``_winapi.CreateProcess`` audit event passing garbage instead of the
+*command_line* argument to audit hooks.

Modules/_winapi.c

@@ -1368,7 +1368,7 @@ _winapi_CreateProcess_impl(PyObject *module, const wchar_t *application_name,
     wchar_t *command_line_copy = NULL;
     AttributeList attribute_list = {0};
 
-    if (PySys_Audit("_winapi.CreateProcess", "uuu", application_name,
+    if (PySys_Audit("_winapi.CreateProcess", "uOu", application_name,
                     command_line, current_directory) < 0) {
         return NULL;
     }