Only so-called "ref" (and "out") variables/returns/fields can point to the inside of an object. These follow some borrow-checking rules so they can also point into stack variables, thus only ref-like types like Span<T> can hold ref and ref-like fields, and these are always rooted in the stack. But refs into the inside of a class type can escape the function, because they can keep the object alive.