In C#, ref and out params are, as far as I know, passed by passing only the raw address of the relevant value. That address may be an interior poin
ref
out
Your code compiles to
IL_0001: newobj instance void Foo::.ctor() IL_0006: ldflda int32 Foo::'field' IL_000b: call void Foo::Increment(int32&)
AFAIK, the ldflda instruction creates a reference to the object containing the field, for as long as the address is on the stack (until the call completes).
ldflda
call