You read the pointer from memory, unbox the pointer into an integer, do arithmetic, then box it back up and write it back into memory. The pointer-as-integer stays in registers while you do arithmetic on it.

You're not supposed to do pointer arithmetic with these pointers. It's generally meant for storing pointers "at rest".

Looks like the current patch only deals with instruction pointers, but I'd assume that for data, the base pointers would have validation instructions automatically inserted before offset arithmetic is done.