What is the Pinned Object Heap (POH), and when should you allocate pinned arrays instead of using fixed or GCHandle?

1. How fixed is implemented

unsafe static int Sum(byte[] data)
{
    fixed (byte* p = data)
    {
        int sum = 0;
        for (int i = 0; i < data.Length; i++) sum += p[i];
        return sum;
    }
}

The compiler emits a pinned local (.locals init (uint8& pinned V_0) in IL). The JIT reports it in GC info as pinned. If a GC happens while the method is inside the block, the GC sees the pinned local and doesn't move the array. No handle table entry, no allocation: that's why fixed is cheap. The danger is only duration: a fixed block that loops for seconds becomes a long pin.

2. GC handles

GCHandle.Alloc(obj, GCHandleType.Pinned) creates an entry in the runtime's handle table. The GC scans handle tables as roots each collection. Pinned handles are roots and immovable. Leaking them (never calling Free) is both a memory leak and a permanent fragmentation source.

Handle types for comparison:

3. Async I/O and pinning

For overlapped I/O on Windows, the OS writes into your buffer after the call returns, so the buffer must stay pinned until completion. With per-operation pins on fresh arrays, every in-flight receive is a pin in Gen 0. A server with many idle connections waiting on reads holds many long pins. Pre-pinned POH buffers make this a non-issue. (On Linux, the socket implementation reads when data is ready, which pins for shorter periods, but pooled pinned buffers still avoid repeated pin/unpin work.)

4. A minimal slab pool on the POH

public sealed class PinnedSlabPool
{
    private readonly byte[] _slab;
    private readonly int _blockSize;
    private readonly ConcurrentBag<int> _free = new();

    public PinnedSlabPool(int blockSize, int blockCount)
    {
        _blockSize = blockSize;
        _slab = GC.AllocateUninitializedArray<byte>(blockSize * blockCount, pinned: true);
        for (int i = 0; i < blockCount; i++) _free.Add(i);
    }

    public bool TryRent(out int block, out Memory<byte> memory)
    {
        if (_free.TryTake(out block))
        {
            memory = _slab.AsMemory(block * _blockSize, _blockSize);
            return true;
        }
        memory = default;
        return false;
    }

    public void Return(int block) => _free.Add(block);
}

In real code you would wrap this as a MemoryPool<byte> returning IMemoryOwner<byte>, so ownership and disposal are explicit (see the MemoryPool<T> question).

5. The "no references" rule

GC.AllocateArray<T>(n, pinned: true) throws ArgumentException if T contains references (RuntimeHelpers.IsReferenceOrContainsReferences<T>() is true). The practical reasons it is a good constraint:

• POH buffers exist to be handed to native code or the OS, which treats them as raw bytes. A GC-tracked reference inside them could be overwritten by native code.
• A reference-free object never needs its contents scanned or updated by the GC, which keeps a never-compacted heap cheap to manage.

For exact runtime design notes, check the .NET runtime GC documentation; for interviews, knowing the rule and its practical consequence is what matters.

6. POH vs LOH vs native memory

7. Diagnosing pinning

• dotnet-counters: POH size, fragmentation.
• dotnet-dump analyze → gchandles -stat (pinned handle counts), gcwhere <addr>.
• GC trace events include pinned object information per collection with verbose GC events.
• GC.GetGCMemoryInfo().PinnedObjectsCount gives the number of pinned objects seen in the last GC.

8. Version notes

9. Try it yourself

1. Run the code example: confirm the slab's address is unchanged after GC.Collect() and GetGeneration reports 2.
2. Try GC.AllocateArray<string>(10, pinned: true) and observe the ArgumentException.
3. Allocate 10,000 small arrays and pin each with a GCHandle for 30 seconds while allocating garbage; watch PinnedObjectsCount and FragmentedBytes from GC.GetGCMemoryInfo().
4. Repeat with one POH slab sliced 10,000 ways and compare.
5. Take a dump of the first version and run gchandles -stat in dotnet-dump analyze.
6. Write a P/Invoke to a C function taking byte* and call it with fixed vs a pinned POH buffer; benchmark both.

using System.Runtime.CompilerServices;

// One long-lived pinned slab, sliced into fixed-size I/O buffers
const int BufferSize = 16 * 1024;
const int Count = 64;
byte[] slab = GC.AllocateUninitializedArray<byte>(BufferSize * Count, pinned: true);

Memory<byte> Buffer(int index) => slab.AsMemory(index * BufferSize, BufferSize);

nint before = AddressOf(slab);
GC.Collect(); // demo only
nint after = AddressOf(slab);

Console.WriteLine($"Generation: {GC.GetGeneration(slab)}");               // 2 (POH is collected with Gen 2)
Console.WriteLine($"Address stable across GC: {before == after}");      // True: POH objects never move

// Safe to hand the address to native code for as long as the slab lives
Memory<byte> first = Buffer(0);
first.Span.Fill(0x2A);
Console.WriteLine($"First buffer starts with {first.Span[0]}");

GCGenerationInfo poh = GC.GetGCMemoryInfo().GenerationInfo[4];
Console.WriteLine($"POH size after last GC: {poh.SizeAfterBytes:N0} bytes");

static unsafe nint AddressOf(byte[] array) => (nint)Unsafe.AsPointer(ref array[0]);

Requires <AllowUnsafeBlocks>true</AllowUnsafeBlocks> for the address check.