I need to get the path to the native (rather than the WOW) program files directory from a 32bit WOW process.
When I pass CSIDL_PROGRAM_FILES (or CSIDL_PROGRAM_FILESX86)
You're on the right path - Use the KNOWNFOLDERID of FOLDERID_ProgramFilesX64
The SHGetKnownFolderPath function can be used to retrieve the full path of a given KnownFolder.