Heap segments can not be passed to native code, but the current code generated for address unboxing doesn't check for heap segments. Passing a heap segment to native code will not be caught, and as a result a malformed pointer (derived from the heap segment's offset + array base) is passed to native code instead.

(similar rules should apply to MemorySegments returned from upcalls)