The same handles are used in both messages. This works because libc destroys the first message and closes its handles before reading the second one, so only one copy of each handle will exist in the new process at one time.