What are pointers and references in .NET? How do object references, ref/in/out parameters, ref locals, Span<T> and unsafe pointers differ?

1. What the GC sees

stack frame                       heap
+----------------------+
| c (object ref) ------+------->  [header][MethodTable*][Name ref][Age int]
| r (ref int)  --------+----------------------------------------^          (interior pointer
| p (int*)  0x7FF8...  |  untracked: if the object moves, p now      into the same object)
+----------------------+  points at garbage

The GC reports and updates c and r. p is just a number; that's why it needs fixed.

2. Why managed pointers can't go on the heap

A ref might point to a stack local. If it were stored in a heap object, it could outlive the stack frame and point at reused memory. So the runtime restricts managed pointers to the stack and to ref struct fields, and the compiler checks that a ref never escapes the scope of what it refers to. That's also why Span<T> can't be a class field or cross an await.

3. Spans over three kinds of memory

Span<byte> a = new byte[64];                  // heap array
Span<byte> b = stackalloc byte[64];           // stack
unsafe { Span<byte> c = new((void*)NativeMemory.Alloc(64), 64); }   // native (free it later)

All three expose the same API with bounds checks. Code written against Span<byte> doesn't care where the bytes live.

4. Pinning and the GC

Long-lived pinned objects in gen 0 stop the GC compacting around them, which can grow the heap. Sockets and file I/O in .NET use the pinned object heap or native memory internally for this reason.

5. Useful safe-but-low-level APIs

• CollectionsMarshal.AsSpan(list): a span over a List<T>'s backing array (don't add or remove items while using it).
• CollectionsMarshal.GetValueRefOrAddDefault(dictionary, key, out exists): update a dictionary value in place with one lookup.
• MemoryMarshal.Cast<TFrom, TTo>: reinterpret a span of bytes as a span of structs (watch alignment and endianness).
• Unsafe.As, Unsafe.Add: no bounds checks; reserve for benchmarked inner loops.

6. Security and reliability

unsafe code reintroduces buffer overruns and use-after-free bugs, the classic sources of memory-corruption vulnerabilities. Keep it isolated, reviewed, fuzzed or property-tested, and prefer spans, which are bounds-checked and usually just as fast because the JIT removes provably redundant checks.

7. Try it yourself

1. Write void Increment(ref int value) and call it on an array element and a local. Then do the same with a struct inside a List<T> using CollectionsMarshal.AsSpan.
2. Return a ref to the largest element of an array and modify it through the returned ref.
3. Write the same checksum over a byte[] using Span<byte>, unsafe pointers with fixed, and MemoryMarshal.GetReference + Unsafe.Add, and benchmark all three.
4. Try to store a Span<byte> in a class field and use it after an await; read the compiler errors.

namespace PointersAndRefs;

using System.Runtime.InteropServices;

public record struct Counter(string Name, int Count);

public static class Program
{
    public static void Main()
    {
        // Object reference: two variables, one object.
        var a = new List<int> { 1 };
        var b = a;
        b.Add(2);
        Console.WriteLine(a.Count);                       // 2

        // ref to an array element: update in place.
        int[] scores = [10, 50, 30];
        ref int max = ref LargestElement(scores);
        max = 99;
        Console.WriteLine(string.Join(",", scores));      // 10,99,30

        // Update structs inside a List<T> without copying them out and back.
        var counters = new List<Counter> { new("a", 0), new("b", 0) };
        foreach (ref var counter in CollectionsMarshal.AsSpan(counters))
        {
            counter.Count++;
        }
        Console.WriteLine(counters[0].Count);             // 1

        // One dictionary lookup to add-or-update.
        var totals = new Dictionary<string, int>();
        ref int total = ref CollectionsMarshal.GetValueRefOrAddDefault(totals, "au", out _);
        total += 5;
        Console.WriteLine(totals["au"]);                  // 5

        Console.WriteLine(Checksum(scores.AsSpan()));
        Console.WriteLine(ChecksumUnsafe(scores));
    }

    private static ref int LargestElement(int[] values)
    {
        int index = 0;
        for (var i = 1; i < values.Length; i++)
        {
            if (values[i] > values[index]) index = i;
        }
        return ref values[index];
    }

    private static long Checksum(ReadOnlySpan<int> values)
    {
        long sum = 0;
        foreach (var v in values) sum += v;
        return sum;
    }

    // Requires <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
    private static unsafe long ChecksumUnsafe(int[] values)
    {
        long sum = 0;
        fixed (int* start = values)                       // pin while we hold a raw pointer
        {
            for (int* p = start, end = start + values.Length; p < end; p++)
            {
                sum += *p;
            }
        }
        return sum;
    }
}