What happens to the address space after fork?

A strong answer

A strong candidate frames What happens to the address space after fork? around the exact memory layout, compiler semantics, and hardware execution model covered in Process Lifecycle: fork, execve, and Address Space Duplication. Explain copy-on-write duplication, shared file descriptors, and that the child gets a copy of the parent's memory.

In some operating systems (such as Windows with CreateProcess), launching a program is a monolithic operation: you pass an executable path, command-line arguments, environment variables, security attributes, and process flags into a single function call.

Unix took a radically different architectural path: it split process creation into two independent primitives:

1. fork(): Duplicates the current running process into an identical child clone.
2. execve(): Completely replaces the current process memory image with a brand-new executable from disk.

In a production interview, always connect the specification rule to its concrete runtime consequence: state what lives on the stack versus the heap or static storage segment, how the compiler or operating system validates alignments, lifetimes, and error codes, and what happens under adversarial or boundary inputs (such as zero-length buffers, integer overflow, concurrent mutation, or partial I/O). Backing your explanation with a small trace of register/memory state transitions immediately separates senior systems engineers from candidates who only memorized syntax.

What the interviewer is listening for

• Mastery of core invariant: Trace dual execution branches using the distinct return values of fork.
• Mastery of core invariant: Inspect how the CPU Memory Management Unit implements Copy-on-Write (COW) page sharing.
• Mastery of core invariant: Replace calling process memory images atomically with new binaries using execve.
• Hardware and ABI awareness: Explaining how sizes, alignments, calling conventions, or kernel boundaries behave on real 64-bit targets rather than relying on implementation-defined assumptions.
• Defensive engineering: Naming the exact compiler flags (-Wall -Wextra -Werror), static analyzers, or runtime sanitizers (-fsanitize=address,undefined,thread) that verify correctness in CI.

Common mistakes

• Explaining only surface syntax without tracing the underlying memory addresses, ownership lifetime, or kernel/user-space state transitions.
• Assuming undefined behavior (such as signed overflow, uninitialized reads, strict-aliasing violations, or dangling pointers) will "just work" because it passed an unoptimized -O0 debug build.
• Ignoring return codes, partial reads/writes, alignment padding, or cleanup paths when an allocation or syscall fails midway through a function.