PR 30142 is sufficient for Unix, but it's missing a bit for Windows.

In Windows, the C runtime library maps the console event for Ctrl+Break to SIGBREAK. The default handler for SIGBREAK exits with 0xC000013A (i.e. STATUS_CONTROL_C_EXIT). This value is unrelated to the value of signal.SIGBREAK (21) or signal.SIGINT (2).

To forcefully terminate a process, Windows taskkill and Task Manager, and pretty much all utilities that can kill a process, call TerminateProcess() with 1 as the exit status. There's no way to know that this is a forced termination as opposed to an unhandled error.

The internal terminate() method in Windows uses 0x10000 as the real exit status of the process, but the internal wait() method maps this to -signal.SIGTERM (-15). Thus the case of calling Process.terminate(), and only this case, is faked in Windows to look like the process was killed by a signal.