proc_open() with the $cmd as an array will quote all the arguments.
Try running the resultant command yourself:

C:\>"C:\Windows\System32\msiexec.exe" "TargetDir=C:\TargetDir" "/qb" "/a" "a.msi"

What you need to do is

$a = "C:\\Windows\\System32\\msiexec.exe TargetDir=C:\\TargetDir /qb /a a.msi";

The important thing is that you do not quote the TargetDir option or the flags. If the filename is variable then you may quote it (using escapeshellarg) - this works because msiexec specifically supports it.

Apparently, msiexec.exe does not use the supplied argv[1], but
rather GetCommandLine() doing its own parsing of the arguments.
Other commands may do this as well, so we should at least document
this issue.

[1] <https://docs.microsoft.com/en-us/cpp/cpp/main-function-command-line-args?view=vs-2019#parsing-c-command-line-arguments>

> proc_open() with the $cmd as an array will quote all the arguments.

With a POSIX shell, this is fine. As with non special characters, a quoted
string is the same as a non quoted string. So with a POSIX shell, these would
be the same:

    /a
    '/a'

but the Windows shell is not POSIX. And quoting should only be used when it is
needed. A command like this will succeed:

    msiexec.exe TargetDir=C:\TargetDir /qb /a a.msi

but add quotes and it fails:

    msiexec.exe TargetDir=C:\TargetDir /qb "/a" a.msi

So it seems strange that "proc_open" assumes this is the correct thing to do for
all platforms. As detailed in the original post, other languages dont do that.
To make it worse, "escapeshellarg" is broken on Windows as well:

> On Windows, escapeshellarg() instead replaces percent signs, exclamation marks
> (delayed variable substitution) and double quotes with spaces and adds double
> quotes around the string. 

https://php.net/function.escapeshellarg

From a security standpoint that might be fine, but makes it impossible to run
some valid external commands from PHP on Windows platform. As a workaround, I
wrote this function:

    function f_escape_sh($s_in) {
       $s_out = preg_replace('/"/', '""', $s_in);
       if ($s_out != $s_in) {
          return '"' . $s_out . '"';
       }
       $n_mat = preg_match('/[ &>^-]/', $s_in);
       if ($n_mat == 1) {
          return '"' . $s_out . '"';
       }
       return $s_out;
    }

If $cmd is an array, the bypass_shell option is implicitly set, so
there is no shell (COMSPEC) involved.  Thus, shell escaping does
not apply.  Instead, the arguments are escaped in conformance to
how parsing C++ command line arguments is documented[1].  This
works fine, if the executed command actually uses the runtime
supplied argv[]; msiexec.exe unfortunately does not.

Admittedly, the escaping applied to the $cmd array elements, as
well as that of escapeshellarg() does more than necessary, but
that can't be changed for BC reasons (at least not for stable PHP
branches).

[1] <https://docs.microsoft.com/en-us/cpp/cpp/main-function-command-line-args?view=vs-2019#parsing-c-command-line-arguments>