NTSTATUS 297 (STATUS_PROCESS_CLONED): meaning and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The current native process-creation path is running in the cloned child process.

Could be also:
Constant	Type	OS
WORKER_THREAD_RETURNED_WITH_BAD_PAGING_IO_PRIORITY	BugCheck Code	Windows

Previous	Next
STATUS_INTERRUPT_STILL_CONNECTED	STATUS_FILE_LOCKED_WITH_ONLY_READERS

STATUS_PROCESS_CLONED

Execution is continuing in the cloned process

STATUS_PROCESS_CLONED is an informational native status used around process-cloning machinery. It distinguishes the child side of a clone operation from the original caller. This is lower-level behavior than the normal Win32 CreateProcess contract and should be interpreted in the context of the native routine that returned it.

Capture the parent and child process IDs, the native clone call and the execution point immediately after the operation. The child inherits a snapshot of process state according to the cloning mechanism, so code must distinguish resources that can be reused from state that needs child-side reinitialization. Do not present the status as an ordinary process-creation failure.

What to inspect

Record parent and cloned process IDs and the native process API used.
Identify the branch that handles child-side return semantics.
Audit locks, thread-specific state, and handles that require reinitialization after cloning.

References

Looking for a different code? Search another status or error code.